diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d3b02e2dc5..6d426ee40d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,7 +1,7 @@
 variables:
   GIT_SUBMODULE_STRATEGY: recursive
   K8S_PLAYGROUND_ROLE: k8s:v1/app-play1/namespace/threat-research/role/deployer
-  K8S_STAGING_ROLE: k8s:v1/app-stage1/namespace/tr-st-deploy/role/deployer
+  K8S_GSTAGING_ROLE: k8s:v1/kube-wicket-iad10/namespace/tr-st-deploy/role/deployer
   DOCKER_ROLE: docker:v1/registry/prefix/threat-research
   K8_DEPLOYER_CONTAINER: docker.repo.splunkdev.net/threat-research/k8-deployer
   SMOKETEST_RUNNER: docker.repo.splunkdev.net/threat-research/smoketest-runner
@@ -48,13 +48,13 @@ smoketest_staging:
     - publish_deployer
   image: ${K8_DEPLOYER_CONTAINER}:${CI_COMMIT_SHORT_SHA}
   script:
-    - eval $(go-go vault -a ${K8S_STAGING_ROLE})
+    - eval $(go-go vault -a ${K8S_GSTAGING_ROLE})
     - eval $(go-go vault -a ${DOCKER_ROLE})
     - cd /deployer/k8s
     - ./deployer.sh
     - ./check_deploy_status.sh
   variables:
-    SCSENV: app_staging1
+    SCSENV: app_gstaging1
     SMOKETEST_RUNNER_IMAGE: ${SMOKETEST_RUNNER}:${CI_COMMIT_SHORT_SHA}
   only:
     - /^ssa.*$/
diff --git a/bin/generate.py b/bin/generate.py
index e9bc076ae4..a3a41e6b75 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -340,8 +340,8 @@ def add_rba(detection):
     #     detection['risk_object'] = detection['tags']['risk_object']
     # if 'risk_object_type' in detection['tags']:
     #    detection['risk_object_type'] = detection['tags']['risk_object_type']
-    if 'risk_score' in detection['tags']:
-        detection['risk_score'] = detection['tags']['risk_score']
+    # if 'risk_score' in detection['tags']:
+    #     detection['risk_score'] = detection['tags']['risk_score']
 
     # grab risk message
     if 'message' in detection['tags']:
@@ -350,31 +350,34 @@ def add_rba(detection):
     risk_objects = []
     risk_object_user_types = {'user', 'username', 'email address'}
     risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'}
-    if 'observable' in detection['tags']:
+    if 'observable' in detection['tags'] and 'risk_score' in detection['tags']:
+
         # go through each obervable
         for entity in detection['tags']['observable']:
+
             risk_object = dict()
 
-            # determine if is a user type
+            # determine if is a user type, create risk
             if entity['type'].lower() in risk_object_user_types:
-                risk_object['risk_object_type'] = 'user'
-                detection['risk_object_type'] = 'user'
+                
                 for r in entity['role']:
                     if 'attacker' == r.lower():
-                        # if the role is an attacker this entity is also a threat object
-                        risk_object['threat_object_field'] = entity['name']
-                        risk_object['threat_object_type'] = entity['type'].lower()
+
+                        risk_object['risk_object_type'] = 'user'
+                        risk_object['risk_object_field'] = entity['name']
+                        risk_object['risk_score'] = detection['tags']['risk_score']
+
                         risk_objects.append(risk_object)
 
-            # determine if is a system type
+            # determine if is a system type, create risk
             elif entity['type'].lower() in risk_object_system_types:
-                risk_object['risk_object_type'] = 'system'
-                detection['risk_object_type'] = 'system'
+                
                 for r in entity['role']:
                     if 'attacker' == r.lower():
-                        # if the role is an attacker this entity is also a threat object
-                        risk_object['threat_object_field'] = entity['name']
-                        risk_object['threat_object_type'] = entity['type'].lower()
+                        
+                        risk_object['risk_object_type'] = 'system'
+                        risk_object['risk_object_field'] = entity['name']
+                        risk_object['risk_score'] = detection['tags']['risk_score']
                         risk_objects.append(risk_object)
 
             # if is not a system or user, it is a threat object
@@ -384,11 +387,8 @@ def add_rba(detection):
                 risk_objects.append(risk_object)
                 continue
 
-            detection['risk_object'] = entity['name']
-            risk_object['risk_object_field'] = entity['name']
-            risk_object['risk_score'] = detection['risk_score']
-            risk_objects.append(risk_object)
     detection['risk'] = risk_objects
+    
     return detection
 
 def prepare_detections(detections, deployments, OUTPUT_PATH):
diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2
index e18485fe00..78d87ea00d 100644
--- a/bin/jinja2_templates/savedsearches.j2
+++ b/bin/jinja2_templates/savedsearches.j2
@@ -45,11 +45,8 @@ action.escu.providing_technologies = []
 {% endif %}
 {% if detection.tags.analytic_story is defined %}
 action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
-{% if detection.risk_score is defined %}
+{% if detection.tags.risk_score is defined %}
 action.risk = 1
-action.risk.param._risk_object = {{ detection.risk_object }}
-action.risk.param._risk_object_type = {{ detection.risk_object_type }}
-action.risk.param._risk_score = {{ detection.risk_score }}
 action.risk.param._risk_message = {{ detection.risk_message }}
 action.risk.param._risk = {{ detection.risk | tojson }}
 action.risk.param.verbose = 0
diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-staging.libsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-gstaging.libsonnet
similarity index 72%
rename from bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-staging.libsonnet
rename to bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-gstaging.libsonnet
index 0c64f68503..f48ad86f6d 100644
--- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-staging.libsonnet
+++ b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/environments/smoke-test-gstaging.libsonnet
@@ -5,7 +5,7 @@ local base = import './base.libsonnet';
 base {
   components +: {
     serviceAccountName: "sa-tr-staging",
-    vaultReadPath: 'scpauth-app-stage1/token/threat-research-test.app-stage1',
+    vaultReadPath: 'scpauth-kube-wicket-iad10/token/threat-research-test.app-gstage1',
     tenant: 'research',
     dspEnv: 'staging',
   }
diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/params.libsonnet b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/params.libsonnet
index 68fe14c8e9..8351e4ba9b 100644
--- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/params.libsonnet
+++ b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/params.libsonnet
@@ -6,7 +6,7 @@ local env = std.extVar('qbec.io/env');
 local paramsMap = {
   _: import './environments/base.libsonnet',
   app_play1: import './environments/smoke-test-playground.libsonnet',
-  app_staging1: import './environments/smoke-test-staging.libsonnet',
+  app_gstaging1: import './environments/smoke-test-gstaging.libsonnet',
 };
 
 if std.objectHas(paramsMap, env) then paramsMap[env] else error 'environment ' + env + ' not defined in ' + std.thisFile
diff --git a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/qbec.yaml b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/qbec.yaml
index 10f86b9eca..a949e35e32 100644
--- a/bin/ssa-end-to-end-testing/k8s-deployer/k8s/qbec.yaml
+++ b/bin/ssa-end-to-end-testing/k8s-deployer/k8s/qbec.yaml
@@ -7,9 +7,9 @@ spec:
     app_play1:
       defaultNamespace: threat-research
       server: https://internal.api.app-play1.dev.us-west-2.splunk8s.io
-    app_staging1:
+    app_gstaging1:
       defaultNamespace: tr-st-deploy
-      server: https://internal.api.app-stage1.stage.us-west-2.splunk8s.io
+      server: https://internal.api.kube-wicket-iad10.stage.splunk8s.io
   vars:
     external:
       - name: SCBRANCH
diff --git a/bin/ssa-end-to-end-testing/modules/github_service.py b/bin/ssa-end-to-end-testing/modules/github_service.py
index bec2b63469..a7cafc5fef 100644
--- a/bin/ssa-end-to-end-testing/modules/github_service.py
+++ b/bin/ssa-end-to-end-testing/modules/github_service.py
@@ -35,6 +35,7 @@ class GithubService:
         branch2 = 'develop'
         g = git.Git('security_content')
         changed_ssa_test_files = []
+        ci_changes = False
 
         if branch1 != 'develop':
             differ = g.diff('--name-only', branch1, branch2)
@@ -55,6 +56,10 @@ class GithubService:
                         if file_path_new not in changed_ssa_test_files:
                             changed_ssa_test_files.append(file_path_new)
 
+                # changed CI code
+                if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'):
+                    ci_changes = True
+
         # all SSA test files for nightly build
         else:
             changed_files = sorted(glob.glob('security_content/tests/*/*.yml'))
@@ -64,7 +69,11 @@ class GithubService:
                 if os.path.basename(file_path).startswith('ssa'):
                     changed_ssa_test_files.append(file_path)
 
-        return changed_ssa_test_files
+                # changed CI code
+                if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'):
+                    ci_changes = True
+
+        return changed_ssa_test_files, ci_changes
 
 
 
diff --git a/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py b/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py
index ae57996d4c..cec0be1d22 100644
--- a/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py
+++ b/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py
@@ -8,6 +8,9 @@ import logging
 import os
 import uuid
 import requests
+import time
+import base64
+import json
 
 from http import HTTPStatus
 #from constants import ML_MODEL_CONNECTOR_UUID
@@ -21,7 +24,7 @@ LOGGER = logging.getLogger(__name__)
 TENANT_PLAYGROUND = f"research2"
 TENANT_STAGING = f"research"
 BASE_URL_PLAYGROUND = f"https://api.playground.scp.splunk.com/"
-BASE_URL_STAGING = f"https://api.staging.scp.splunk.com/"
+BASE_URL_STAGING = f"https://api.staging.scs.splunk.com/"
 
 # Streaming Pipelines REST endpoints
 CONNECTIONS_ENDPOINT = f"streams/v3beta1/connections"
@@ -36,13 +39,41 @@ SUBMIT_SEARCH_ENDPOINT = f"search/v2beta1/jobs"
 DATASETS_ENDPOINT = f"catalog/v2beta1/datasets"
 
 
+class ApiError(Exception):
+    pass
+
+
 class DSPApi:
 
-    def __init__(self, env, tenant, header_token):
+    def __init__(self, env, tenant, token):
         self.env = env
         self.tenant = tenant
-        self.header_token = header_token
+        self.header_token = f"Bearer {token}"
+        self.validate_token()
 
+    def validate_token(self):
+        def decode(s):
+            def pad(t):
+                return t + '=' * (len(t) % 4)
+            return json.loads(base64.b64decode(pad(s)))
+
+        token = self.header_token.split()[1]
+        header, payload, signature = token.split('.')
+        payload_data = decode(payload)
+        for k in sorted(payload_data.keys()):
+            LOGGER.info(f"token.payload.{k} = %s", payload_data[k])
+
+        valid_for = payload_data['exp'] - int(time.time())
+        if not valid_for > 0:
+            raise ApiError("Token is expired")
+
+        token_env = payload_data['iss'].split('.')[-4]
+        if self.env != token_env:
+            raise ApiError(f"Env {self.env} was specified but token is for {token_env}")
+
+        token_tenant = payload_data['tenant']
+        if self.tenant != token_tenant:
+            raise ApiError(f"Tenant {self.tenant} was specified but token is for {token_tenant}")
 
     def return_api_endpoint(self, endpoint):
         if self.env == 'playground':
@@ -70,10 +101,11 @@ class DSPApi:
         #LOGGER.info(f"{spl}")
         response = requests.post(self.return_api_endpoint(PIPELINES_COMPILE_ENDPOINT), json=data, headers=request_headers(self.header_token))
         upl = response.json()
-        #LOGGER.info(f"POST compile response_body is: {upl}")
-        LOGGER.info(f"Successfully compile spl to upl")
-        return upl, response
-
+        if response.status_code == HTTPStatus.OK:
+            LOGGER.info(f"Successfully compiled spl to upl")
+            return upl
+        else:
+            LOGGER.error("SPL compilation failed: %s", response.text)
 
     def validate_upl(self, upl):
         """
@@ -93,13 +125,12 @@ class DSPApi:
         headers = {"Content-Type": "application/json", "Authorization": self.header_token}
         data = {"upl": upl}
         response = requests.post(self.return_api_endpoint(PIPELINES_VALIDATE_ENDPOINT), json=data, headers=headers)
-        response_body = response.json()
+
         if response.status_code == HTTPStatus.OK:
             LOGGER.info(f"UPL is validated.")
-            return upl, response_body
+            return upl
         else:
-            LOGGER.error(f"UPL validation failed: {response_body}")
-            return response_body
+            LOGGER.error("UPL validation failed: %s", response.text)
 
 
     def get_pipelines(self):
@@ -141,6 +172,7 @@ class DSPApi:
             "name": f"ssa_smoke_test_pipeline_helper_{set_test_id}",
             "description": "ssa_test_pipeline_description",
             "bypassValidation": "true",
+            "labels": {"app": "ba"},
             "data": upl
         }
         response = requests.post(self.return_api_endpoint(PIPELINES_ENDPOINT), json=data, headers=headers)
@@ -149,6 +181,8 @@ class DSPApi:
             pipeline_id = response_body.get("id")
             #LOGGER.info(f"Pipeline {pipeline_id} successfully created")
             return pipeline_id
+        else:
+            LOGGER.error(f"Failed to create pipeline: %s", response.text)
 
 
     def create_pipeline_from_spl(self, spl):
@@ -156,8 +190,8 @@ class DSPApi:
         helper function to compile and validate from spl text, then create the pipeline
 
         """
-        upl, _ = self.compile_spl(spl)
-        validated_upl, _ = self.validate_upl(upl)
+        upl = self.compile_spl(spl)
+        validated_upl = self.validate_upl(upl)
         pipeline_id = self.create_pipeline(validated_upl)
         LOGGER.info(f"pipeline id created is: {pipeline_id}")
         return pipeline_id
@@ -182,6 +216,7 @@ class DSPApi:
 
         headers = {"Content-Type": "application/json", "Authorization": self.header_token}
         pipelines_activate_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id + "/activate"
+        pipelines_status_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id
 
         data = {
             "activateLatestVersion": "true",
@@ -189,16 +224,35 @@ class DSPApi:
             "skipRestoreState": "true"
         }
 
+        pipeline_activated = False
+        attempts_remaining = 30
+
         response = requests.post(pipelines_activate_endpoint, json=data, headers=headers)
-        response_body = response.json()
 
         if response.status_code == HTTPStatus.OK:
-            pipeline_id = response_body.get("activated")
-            LOGGER.info(f"Pipeline {pipeline_id} successfully activated")
-        else:
-            LOGGER.error(f"Failed to activate pipeline {pipeline_id}: {response.text}")
+            while attempts_remaining:
+                attempts_remaining -= 1
+                pipeline_status_response = requests.get(pipelines_status_endpoint, headers=headers)
+                if pipeline_status_response.status_code == HTTPStatus.OK:
+                    pipeline_status = pipeline_status_response.json()
+                    status = pipeline_status['status']
+                    if status == 'ACTIVATED':
+                        pipeline_activated = True
+                        LOGGER.info(f"Pipeline {pipeline_id} successfully activated")
+                        break
+                    else:
+                        LOGGER.warning("Current pipeline activation status for %s: %s", pipeline_id, status)
+                else:
+                    LOGGER.error("Failed to check pipeline status for %s: %s", pipeline_id, pipeline_status_response.text)
 
-        return response_body
+                if attempts_remaining:
+                    time.sleep(60)
+                else:
+                    LOGGER.error("Got tired of waiting for the pipeline to activate")
+        else:
+            LOGGER.error("Failed to request pipeline activation for %: %s", pipeline_id, response.text)
+
+        return pipeline_activated
 
 
     def deactivate_pipeline(self, pipeline_id):
@@ -368,8 +422,8 @@ class DSPApi:
 
         """
 
-        upl, _ = self.compile_spl(spl)
-        validated_upl, _ = self.validate_upl(upl)
+        upl = self.compile_spl(spl)
+        validated_upl = self.validate_upl(upl)
         preview_id = self.get_preview_id(validated_upl)
         LOGGER.info(f"preview id created is: {preview_id}")
         return preview_id
@@ -390,11 +444,15 @@ class DSPApi:
             response body in JSON format
         """
         data = [{
-            "body": data,
+            "body": event,
             "sourcetype": "WinEventLog"
-            }]
+            } for event in data]
         response = requests.post(self.return_api_endpoint(INGEST_ENDPOINT), json=data, headers=request_headers(self.header_token))
-        return response.json()
+        if response.status_code != HTTPStatus.OK:
+            LOGGER.error(f"Failed to upload data: %s", response.text)
+            return False
+
+        return True
 
 
     def submit_search_job(self, module, query):
@@ -420,7 +478,7 @@ class DSPApi:
         LOGGER.info(f"Submit Search Job")
         response = requests.post(self.return_api_endpoint(SUBMIT_SEARCH_ENDPOINT), json=data, headers=request_headers(self.header_token))
         if response.status_code != HTTPStatus.CREATED:
-            LOGGER.error(f"Submit search job failed.")
+            LOGGER.error(f"Submit search job failed: %s", response.text)
             return None
         else:
             response_body = response.json()
diff --git a/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py b/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py
index fef35db18b..c9042cc1c5 100644
--- a/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py
+++ b/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py
@@ -17,20 +17,19 @@ SLEEP_TIME_CREATE_INDEX = 10
 SLEEP_TIME_ACTIVATE_PIPELINE = 10
 SLEEP_TIME_SEND_DATA = 30
 WAIT_CYCLE = 20
-MAX_EXECUTION_TIME_LIMIT = 300  # per detection test
+MAX_EXECUTION_TIME_LIMIT = 600  # per detection test
 
 TEST_DATASET = 'windows-security_small.txt'
 
 
 class SSADetectionTesting:
 
-    def __init__(self, env, tenant, header_token):
+    def __init__(self, env, tenant, token):
         self.execution_passed = True
         self.max_execution_time = MAX_EXECUTION_TIME_LIMIT
         self.env = env
         self.tenant = tenant
-        self.header_token = f"Bearer {header_token}"
-        self.api = DSPApi(env, tenant, self.header_token)
+        self.api = DSPApi(env, tenant, token)
         self.test_results = {}
 
     def test_dsp_pipeline(self):
@@ -121,15 +120,21 @@ class SSADetectionTesting:
         spl = manipulate_spl(self.api.env, spl, self.results_index)
         assert spl is not None, "fail to manipulate spl file"
 
-        pipeline_id = self.api.create_pipeline_from_spl(spl)
+        upl = self.api.compile_spl(spl)
+        assert upl is not None, "failed to compile spl"
+
+        validated_upl = self.api.validate_upl(upl)
+        assert validated_upl is not None, "failed to validate upl"
+
+        pipeline_id = self.api.create_pipeline(validated_upl)
         assert pipeline_id is not None, "failed to create a pipeline"
 
         _pipeline_status = self.api.pipeline_status(pipeline_id)
         assert _pipeline_status == "CREATED", f"Current status of pipeline {pipeline_id} should be CREATED"
         self.created_pipelines.append(pipeline_id)
 
-        response_body = self.api.activate_pipeline(pipeline_id)
-        assert response_body.get("activated") == pipeline_id, f"pipeline {pipeline_id} should be successfully activate."
+        pipeline_activated = self.api.activate_pipeline(pipeline_id)
+        assert pipeline_activated, f"pipeline {pipeline_id} should be activated."
         self.activated_pipelines.append(pipeline_id)
 
         self.wait_time(SLEEP_TIME_ACTIVATE_PIPELINE)
@@ -145,8 +150,8 @@ class SSADetectionTesting:
 
         assert len(data) > 0, "No events to send, skip to next test."
 
-        for d in data:
-            response_body = self.api.ingest_data(d)
+        data_uploaded = self.api.ingest_data(data)
+        assert data_uploaded, "Failed to upload test data"
 
         self.wait_time(SLEEP_TIME_SEND_DATA)
 
@@ -197,7 +202,7 @@ class SSADetectionTesting:
         self.activated_pipelines = [p for p in self.activated_pipelines if not deactivate_pipeline(p)]
         self.created_pipelines = [p for p in self.created_pipelines if not delete_pipeline(p)]
         if len(self.activated_pipelines) > 0 or len(self.created_pipelines) > 0 or not delete_index(self.results_index):
-            LOGGER.warning("Not all SCS resources fred up")
+            LOGGER.warning("Not all SCS resources freed up")
             LOGGER.info(f"Created Pipelines: {','.join(self.created_pipelines)}")
             LOGGER.info(f"Active Pipelines: {','.join(self.activated_pipelines)}")
             LOGGER.info(f"Result Indexes: {self.results_index}")
diff --git a/bin/ssa-end-to-end-testing/modules/utils.py b/bin/ssa-end-to-end-testing/modules/utils.py
index 0894f361b9..77dcb226b5 100644
--- a/bin/ssa-end-to-end-testing/modules/utils.py
+++ b/bin/ssa-end-to-end-testing/modules/utils.py
@@ -14,12 +14,11 @@ LOGGER = logging.getLogger(__name__)
 # Macros
 PULSAR_SOURCE_CONNECTION_ID_PLAYGROUND = f"29fb61f1-9342-48f5-9793-1afa008c377b"
 PULSAR_SOURCE_TOPIC_PLAYGROUND = f"persistent://ssa/egress/decorated-events-research2"
-PULSAR_SOURCE_CONNECTION_ID_STAGING = f"b8c81601-a7e0-4501-802c-cb2831c72b6f"
+PULSAR_SOURCE_CONNECTION_ID_STAGING = f"d156ed3a-1254-469a-bffc-9dd6eda97ac6"
 PULSAR_SOURCE_TOPIC_STAGING = f"persistent://ssa/egress/decorated-events-research"
 
-READ_SSA_ENRICHED_EVENTS = f"| from read_ssa_enriched_events()"
 READ_SSA_ENRICHED_EVENTS_EXPANDED = (
-    f"| from pulsar(\"__PULSAR_SOURCE_CONNECTION_ID__\", \"__PULSAR_SOURCE_TOPIC__\")"
+    f"pulsar(\"__PULSAR_SOURCE_CONNECTION_ID__\", \"__PULSAR_SOURCE_TOPIC__\")"
     f"| eval input_event=deserialize_json_object(value)"
     f"| select input_event"
     f"| eval _datamodels=ucast(map_get(input_event, \"_datamodels\"), \"collection<string>\", [])"
@@ -29,7 +28,6 @@ READ_SSA_ENRICHED_EVENTS_EXPANDED = (
 # not used in the moment
 # PULSAR_SINK_CONNECTION_ID = f"29fb61f1-9342-48f5-9793-1afa008c377b"
 # PULSAR_SINK_TOPIC = f"persistent://ssa/ingress/detection-events-research2"
-WRITE_SSA_DETECTED_EVENTS = f"| into write_ssa_detected_events();"
 
 # ## dummy values ##
 # DETECTION_TYPE = f"anomaly"
@@ -87,11 +85,12 @@ def manipulate_spl(env, spl, results_index):
         .replace("__PULSAR_SOURCE_CONNECTION_ID__", pulsar_source_connection_id)\
         .replace("__PULSAR_SOURCE_TOPIC__", pulsar_source_topic)
     # Obtain the test sink
-    sink = ";"
     if results_index is not None:
         module = results_index["module"]
         index = results_index["name"]
-        sink = f"| into index(\"{module}\", \"{index}\");"
+        sink = f"index(\"{module}\", \"{index}\")"
+    else:
+        sink = "write_null()"
     # Replace spl template with its `source` and `sink`
     spl = replace_ssa_macros(source, sink, spl)
     LOGGER.info(f"spl: {spl}")
@@ -105,8 +104,8 @@ def read_spl(file_path, file_name):
 
 
 def replace_ssa_macros(source, sink, spl):
-    spl = spl.replace(READ_SSA_ENRICHED_EVENTS, source)
-    spl = spl.replace(WRITE_SSA_DETECTED_EVENTS, sink)
+    spl = re.sub(r'read_ssa_enriched_events\(\s*\)', source, spl, flags=re.IGNORECASE)
+    spl = re.sub(r'write_ssa_detected_events\(\s*\)', sink, spl, flags=re.IGNORECASE)
     return spl
 
 
@@ -121,7 +120,7 @@ def read_data(file_path):
     tmp_counter = 0
     for line in fileinput.input(files=modified_file):
         i = i + 1
-        if event != "" and re.match(date_rex, line):
+        if event.strip() != "" and re.match(date_rex, line):
             data.append(event)
             tmp_counter = 0
             event = line
diff --git a/bin/ssa-end-to-end-testing/run_ssa_smoketest.py b/bin/ssa-end-to-end-testing/run_ssa_smoketest.py
index 0a04350170..396b4d8ea6 100644
--- a/bin/ssa-end-to-end-testing/run_ssa_smoketest.py
+++ b/bin/ssa-end-to-end-testing/run_ssa_smoketest.py
@@ -39,22 +39,30 @@ def main(args):
 
     # Retrieve Security Content
     github_service = GithubService(branch)
+    ci_changes = False
     if test_file:
         if not os.path.isfile('security_content/tests/' + test_file):
             LOGGER.error('Can not find specified test file')
             sys.exit(1)
         test_files_ssa = [str("tests/" + test_file)]
     else:
-        test_files_ssa = github_service.get_changed_test_files_ssa()
+        test_files_ssa, ci_changes = github_service.get_changed_test_files_ssa()
     
     LOGGER.info('changed/added GitHub files:')
     for test_file in test_files_ssa:
         LOGGER.info(test_file)
 
-    if len(test_files_ssa) == 0:
+    if ci_changes:
+        LOGGER.info('CI code has changed')
+
+    if len(test_files_ssa) == 0 and not ci_changes:
         LOGGER.info('Nothing to test for SSA smoke test.')
         sys.exit(0)
 
+    if len(test_files_ssa) == 0 and ci_changes and fast:
+        LOGGER.error('Cannot test CI changes since no detections/tests have changed and running in fast mode.')
+        sys.exit(-1)
+
     # test DSP and SSA pipeline
     ssa_detection_testing = SSADetectionTesting(env, tenant, token)
     if not fast:
diff --git a/bin/ssa-end-to-end-testing/ssa_compile_check.py b/bin/ssa-end-to-end-testing/ssa_compile_check.py
new file mode 100644
index 0000000000..d6ba79caac
--- /dev/null
+++ b/bin/ssa-end-to-end-testing/ssa_compile_check.py
@@ -0,0 +1,108 @@
+import os
+import sys
+import base64
+import configparser
+import time
+import yaml
+import argparse
+from modules.ssa_utils import *
+from modules.utils import manipulate_spl
+from modules.streams_service_api_helper import DSPApi
+
+
+def main(args):
+    parser = argparse.ArgumentParser()
+    parser.add_argument('detection', nargs='+', type=str, help='detection yaml to be checked')
+    opts = parser.parse_args(args)
+
+    api = get_api()
+    if api is None:
+        print("No valid tokens found")
+        sys.exit(-1)
+
+    results = {}
+    for detection_path in opts.detection:
+        if not os.path.exists(detection_path):
+            print(f"File {detection_path} does not exist")
+            continue
+
+        with open(detection_path, 'rt') as f:
+            detection = yaml.safe_load(f)
+        name = os.path.basename(detection_path)
+
+        spl = manipulate_spl(api, detection['search'], None)
+        if spl is None:
+            results[name] = 'failed to manipulate SPL'
+            continue
+
+        upl = api.compile_spl(spl)
+        if upl is None:
+            results[name] = 'failed to compile SPL'
+            continue
+
+        validated_upl = api.validate_upl(upl)
+        if validated_upl is None:
+            results[name] = 'failed to validate UPL'
+            continue
+
+        results[name] = 'success'
+
+    for name, result in results.items():
+        if result == 'success':
+            print(f"{name}: {result}")
+
+    for name, result in results.items():
+        if result != 'success':
+            print(f"{name} FAILED!!: {result}")
+
+
+def get_api():
+    for token in get_scloud_tokens():
+        env, tenant, good = parse_token(token)
+        if good:
+            return DSPApi(env, tenant, token)
+
+
+def parse_token(token):
+    def decode(s):
+        def pad(t):
+            return t + '=' * (len(t) % 4)
+        return json.loads(base64.b64decode(pad(s)))
+
+    header, payload, signature = token.split('.')
+    payload_data = decode(payload)
+    for k in sorted(payload_data.keys()):
+        print(f"token.payload.{k} = {payload_data[k]}")
+
+    token_env = payload_data['iss'].split('.')[-4]
+    print(f"token env: {token_env}")
+
+    token_tenant = payload_data['tenant']
+    print(f"token tenant: {token_tenant}")
+
+    valid_for = payload_data['exp'] - int(time.time())
+    if valid_for > 60:
+        print("Token is good")
+        token_good = True
+    else:
+        print("Token is expired")
+        token_good = False
+
+    return token_env, token_tenant, token_good
+
+
+def get_scloud_tokens():
+    tokens = []
+    config = configparser.ConfigParser()
+    context_path = os.path.expanduser('~/.scloud_context')
+    config.read(context_path)
+    config.sections()
+    for section in config.sections():
+        token = config[section].get('access_token')
+        if token is not None:
+            tokens.append(token.strip('"'))
+    return tokens
+
+
+if __name__ == '__main__':
+    main(sys.argv[1:])
\ No newline at end of file
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
index 8c5838b030..0e1e20e231 100644
--- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
@@ -51,7 +51,7 @@ tags:
   - ID.AM
   observable:
   - name: user
-    type: user
+    type: User
     role:
     - Attacker
   product:
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
index f26fb81ec2..b9c490d31a 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
@@ -48,6 +48,10 @@ tags:
   nist:
   - ID.AM
   observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
   - name: dest
     type: Endpoint
     role:
diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml
index b33aaa4f90..2cf1e5d425 100644
--- a/detections/cloud/detect_new_open_s3_buckets.yml
+++ b/detections/cloud/detect_new_open_s3_buckets.yml
@@ -13,8 +13,8 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
   | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers")
   | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") |
   rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime
-  max(_time) as lastTime by user_arn userIdentity.principalId userAgent
-  uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission
+  bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_new_open_s3_buckets_filter` '
 how_to_implement: You must install the AWS App for Splunk.
 known_false_positives: While this search has no known false positives, it is possible
@@ -40,8 +40,8 @@ tags:
   impact: 60
   kill_chain_phases:
   - Actions on Objectives
-  message: User $user_arn$ has created an open/public bucket $bucketName$ with the following
-    permissions $permission$
+  message: User $user_arn$ has created an open/public bucket $bucketName$ with the
+    following permissions $permission$
   mitre_attack_id:
   - T1530
   nist:
@@ -73,4 +73,4 @@ tags:
   - uri
   - permission
   risk_score: 48
-  security_domain: threat
\ No newline at end of file
+  security_domain: threat
diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml
index 3c29b3d140..e297f4c0d5 100644
--- a/detections/cloud/detect_shared_ec2_snapshot.yml
+++ b/detections/cloud/detect_shared_ec2_snapshot.yml
@@ -5,8 +5,9 @@ date: '2021-07-20'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel: []
-description: The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions
-  are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. 
+description: The following analytic utilizes AWS CloudTrail events to identify when
+  an EC2 snapshot permissions are modified to be shared with a different AWS account.
+  This method is used by adversaries to exfiltrate the EC2 snapshot.
 search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId
   as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No
   Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id
@@ -22,16 +23,38 @@ tags:
   - Suspicious Cloud Instance Activities
   - Data Exfiltration
   asset_type: EC2 Snapshot
+  automated_detection_testing: passed
   cis20:
   - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
+  impact: 60
   kill_chain_phases:
   - Actions on Objectives
+  message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$
+    by user $user_arn$ from $src_ip$
   mitre_attack_id:
   - T1537
   nist:
   - PR.DS
   - PR.AC
   - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -46,27 +69,5 @@ tags:
   - aws_account_id
   - vendor_region
   - user_agent
-  impact: 60
-  confidence: 80
   risk_score: 48
-  context:
-  - Source:Cloud Data
-  - Scope:External
-  - Outcome:Allowed
-  - Stage:Execution
-  - Stage:Exfiltration
-  message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$
-    by user $user_arn$ from $src_ip$
-  observable:
-  - name: user_arn
-    type: User
-    role:
-    - Attacker
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
   security_domain: threat
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
index 7529b3f6cf..db578d529d 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
@@ -27,11 +27,21 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 13
+  confidence: 50
+  context:
+  - Source:Cloud Data
+  - Stage:Execution
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json
+  impact: 30
+  message: Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
   nist:
   - DE.DP
-  - DE.AE
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -46,7 +56,5 @@ tags:
   - vendor_region
   - severity
   - dest
-  risk_object: dest
-  risk_object_type: system
-  risk_score: 20
-  security_domain: network
+  risk_score: 15
+  security_domain: endpoint
diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index 0ff45e8e49..4f07fe76d9 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -8,31 +8,53 @@ datamodel: []
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
-  to Windows event logs. Dependent upon volume, enable no critical endpoints or all. 
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
   \
 
-  This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in
-  script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
+  This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture
+  the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the
+  most basic use cases for credentials being taken for offline cracking. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
-references: 
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
-  - https://github.com/GossiTheDog/HiveNightmare
-  - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*")
+  AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
+  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM
+  and SECURITY hives.
+references:
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+- https://github.com/GossiTheDog/HiveNightmare
+- https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
 tags:
   analytic_story:
   - Credential Dumping
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: PowerShell was identified running a script to capture the SAM hive on endpoint
+    $ComputerName$ by user $user$.
   mitre_attack_id:
   - T1003.002
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -44,21 +66,5 @@ tags:
   - ComputerName
   - User
   - EventCode
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: ComputerName
-    type: Hostname
-    role:
-    - Victim
\ No newline at end of file
+  security_domain: endpoint
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 4d2783f6eb..c8614a46d0 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -12,10 +12,10 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
   In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
   usage. During triage, validate this is the legitimate version of `PsExec` by review
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
-search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe) |
-  stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
-  process_name, OriginalFileName, process_path, CommandLine Product | rename Computer
-  as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 8a935a1ce6..f3a0805e2f 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -12,11 +12,11 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
   In this instance, we are using `OriginalFileName` from Sysmon to determine if the
   process is WinRAR. During triage, validate additional metadata from the binary that
   this is `WinRAR`. Review parallel processes and file modifications.
-search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
-  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_renamed_winrar_filter`'
+search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
+  process_name!=winrar.exe | stats count min(_time) as firstTime max(_time) as lastTime
+  by Computer, User, parent_process_name, process_name, OriginalFileName, process_path,
+  CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index b83eb213fb..e79aed231f 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -6,59 +6,59 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process.
-  This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the 
-  the actual trickbot payload.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process_name = "mshta.exe"  (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe) by
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid
-  Processes.user Processes.dest 
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
+description: This search is to detect a suspicious mshta.exe process that spawn rundll32
+  or regsvr32 child process. This technique was seen in several malware nowadays like
+  trickbot to load its initial .dll stage loader to execute and download the the actual
+  trickbot payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  = "mshta.exe"  (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe)
+  by Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")`
+  | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used.
-known_false_positives: limitted. this anomaly behavior is not commonly seen in clean host.
+known_false_positives: limitted. this anomaly behavior is not commonly seen in clean
+  host.
 references:
 - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 tags:
   analytic_story:
   - Trickbot
+  confidence: 80
+  context:
+  - source:endpoint
+  - stage: executions
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: a mshta parent process $parent_process_name$ spawn child process $process_name$
+    in host $dest$
   mitre_attack_id:
   - T1218.005
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - parent_process 
-  - process_name 
-  - process 
-  - process_id 
+  - parent_process
+  - process_name
+  - process
+  - process_id
   - process_guid
-  security_domain: endpoint
-  impact: 70
-  confidence: 80
-  # (impact * confidence)/100
   risk_score: 56
-  context: 
-  - source:endpoint
-  - stage: executions
-  message: a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
-  observable:
-    - name: dest
-      type: Hostname
-      role:
-      - Victim
-    - name: user
-      type: user
-      role:
-      - Victim 
+  security_domain: endpoint
diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml
index d9a4abaa6b..f13ad3cef2 100644
--- a/detections/endpoint/net_profiler_uac_bypass.yml
+++ b/detections/endpoint/net_profiler_uac_bypass.yml
@@ -6,33 +6,49 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect modification of registry to bypass UAC windows feature. 
-  This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed.
-  This detection rely on monitoring the registry key and values in the detection area. 
-  It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_name = "*.dll"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `net_profiler_uac_bypass_filter`'
+description: This search is to detect modification of registry to bypass UAC windows
+  feature. This technique is to add a payload dll path on .NET COR file path that
+  will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring
+  the registry key and values in the detection area. It may happened that windows
+  update some dll related to mmc.exe and add dll path in this registry. In this case
+  filtering is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
+  Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
   that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: limited false positive. It may trigger by some windows update that will modify this registry.
+known_false_positives: limited false positive. It may trigger by some windows update
+  that will modify this registry.
 references:
 - https://offsec.almond.consulting/UAC-bypass-dotnet.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
   mitre_attack_id:
   - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -42,22 +58,6 @@ tags:
   - Registry.registry_path
   - Registry.registry_key_name
   - Registry.registry_value_name
-  - Registry.dest 
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
+  - Registry.dest
   risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  
+  security_domain: endpoint
diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml
index 9a0d1818e9..2a70599ab2 100644
--- a/detections/endpoint/office_product_spawn_cmd_process.yml
+++ b/detections/endpoint/office_product_spawn_cmd_process.yml
@@ -6,60 +6,61 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: this search is to detect a suspicious office product process that spawn cmd child process.
-  This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin 
-  relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") 
-  Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid
-  Processes.user Processes.dest 
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
+description: this search is to detect a suspicious office product process that spawn
+  cmd child process. This is commonly seen in a ms office product having macro to
+  execute shell command to download or execute malicious lolbin relative to its malicious
+  code. This is seen in trickbot spear phishing doc where it execute shell cmd to
+  run mshta payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
+  = "powerpnt.exe") Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `office_product_spawn_cmd_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: IT or network admin may create an document automation that will run shell script.
+  Sysmon TA.
+known_false_positives: IT or network admin may create an document automation that
+  will run shell script.
 references:
 - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 tags:
   analytic_story:
   - Trickbot
+  confidence: 80
+  context:
+  - source:endpoint
+  - stage: executions
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: an office product parent process $parent_process_name$ spawn child process
+    $process_name$ in host $dest$
   mitre_attack_id:
   - T1218.005
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - parent_process 
-  - process_name 
-  - process 
-  - process_id 
+  - parent_process
+  - process_name
+  - process
+  - process_id
   - process_guid
-  security_domain: endpoint
-  impact: 70
-  confidence: 80
-  # (impact * confidence)/100
   risk_score: 56
-  context: 
-  - source:endpoint
-  - stage: executions
-  message: an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
-  observable:
-    - name: dest
-      type: Hostname
-      role:
-      - Victim
-    - name: user
-      type: user
-      role:
-      - Victim 
-  
\ No newline at end of file
+  security_domain: endpoint
diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml
index ef1b49aa43..fb1765f6ee 100644
--- a/detections/endpoint/sam_database_file_access_attempt.yml
+++ b/detections/endpoint/sam_database_file_access_attempt.yml
@@ -6,47 +6,42 @@ author: Michael Haag, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database.
-  The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
-search: '`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") 
-  | stats values(Accesses) count by process_name Object_Name  dest user 
-  | `sam_database_file_access_attempt_filter`'
+description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases'
+  within the file path of `windows\system32\config` using Windows Security EventCode
+  4663. This particular behavior is related to credential access, an attempt to either
+  use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security
+  Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7,
+  8.1 and 10 that stores users' passwords.
+search: '`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name
+  IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*")
+  | stats values(Accesses) count by process_name Object_Name  dest user | `sam_database_file_access_attempt_filter`'
 how_to_implement: To successfully implement this search, you must ingest Windows Security
-  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`. 
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: Natively, `dllhost.exe` will access the files. Every environment
+  will have additional native processes that do as well. Filter by process_name. As
+  an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
 references:
-  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
-  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
-  - https://github.com/GossiTheDog/HiveNightmare
-  - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
-  - https://en.wikipedia.org/wiki/Security_Account_Manager
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+- https://github.com/GossiTheDog/HiveNightmare
+- https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+- https://en.wikipedia.org/wiki/Security_Account_Manager
 tags:
   analytic_story:
   - Credential Dumping
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1003.002
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - process_name 
-  - Object_Name
-  - dest
-  - user 
-  security_domain: endpoint
-  impact: 80
   confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Credential Access
-  message: The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$.
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: The following process $process_name$ accessed the object $Object_Name$
+    attempting to gain access to credentials on $dest$ by user $user$.
+  mitre_attack_id:
+  - T1003.002
   observable:
   - name: user
     type: User
@@ -63,4 +58,16 @@ tags:
   - name: Object_Name
     type: File
     role:
-    - Other
\ No newline at end of file
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - Object_Name
+  - dest
+  - user
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml
index 46c40a464f..45477c7d1c 100644
--- a/detections/endpoint/sdclt_uac_bypass.yml
+++ b/detections/endpoint/sdclt_uac_bypass.yml
@@ -6,17 +6,17 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious sdclt.exe registry modification. 
-  This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry 
-  that sdclt.exe tries to open or query with payload file path on it to be executed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") 
+description: This search is to detect a suspicious sdclt.exe registry modification.
+  This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe
+  application by modifying some registry that sdclt.exe tries to open or query with
+  payload file path on it to be executed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App
+  Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*")
   (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand")
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `sdclt_uac_bypass_filter`'
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -28,12 +28,27 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
   mitre_attack_id:
   - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -44,21 +59,5 @@ tags:
   - Registry.registry_key_name
   - Registry.registry_value_name
   - Registry.dest
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
   risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  
+  security_domain: endpoint
diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml
index c1e2ef750e..61b5025568 100644
--- a/detections/endpoint/silentcleanup_uac_bypass.yml
+++ b/detections/endpoint/silentcleanup_uac_bypass.yml
@@ -6,15 +6,15 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious modification of registry that may related to UAC bypassed.
-  This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_name = "*.exe*"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `silentcleanup_uac_bypass_filter`'
+description: This search is to detect a suspicious modification of registry that may
+  related to UAC bypassed. This registry will be trigger once the attacker abuse the
+  silentcleanup task schedule to gain high privilege execution that will bypass User
+  control account.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir"
+  Registry.registry_value_name = "*.exe*" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -26,12 +26,27 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
   mitre_attack_id:
   - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -41,22 +56,6 @@ tags:
   - Registry.registry_path
   - Registry.registry_key_name
   - Registry.registry_value_name
-  - Registry.dest 
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
+  - Registry.dest
   risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index fe2cea836d..34c9b335f7 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -9,13 +9,14 @@ description: This detection indicates use of Mimikatz modules that facilitate Pa
   attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
-  null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true
   OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
   OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
index d948df75f4..2affa0592c 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
@@ -12,7 +12,8 @@ description: Stolen credentials are applied by methods such as user impersonatio
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line,
   /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true
   OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
index 4e279727c4..246e984832 100644
--- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
@@ -10,12 +10,13 @@ description: This detection identifies use of DSInternals modules that verify pa
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index a455f73c58..9d39025a6d 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name
   = "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index febf8227db..e5caebf89a 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -16,10 +16,11 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line,
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line,
   "%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
-  "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name",
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])
   | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index ee5b4bdd4c..6441eec695 100644
--- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -11,14 +11,15 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
   "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
   "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
-  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
+  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
   | where process_name="cmd.exe" OR process_name="reg.exe" | where cmd_line != null  AND
   match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true
   OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true
   OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line,
   /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
   ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
-  dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events(); '
 how_to_implement: You must be ingesting windows endpoint data that tracks process
   activity, including parent-child relationships from your endpoints.
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
index e7a6189558..cebe556d37 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
@@ -16,7 +16,8 @@ search: '| from read_ssa_enriched_events()
   process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
   "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
   OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
   /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
   OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
@@ -26,7 +27,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
index 61d03803c6..64443087f7 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events()
   process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
   "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
   OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
   /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
   OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
index 9570d6ce16..eeecf916ea 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
@@ -17,14 +17,15 @@ search: ' | from read_ssa_enriched_events()
   cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
   "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND process_name != null AND parent_process_name
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null AND parent_process_name
   != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true
   AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path,
   /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
index cb1d83ee82..94ca112edc 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
@@ -16,13 +16,14 @@ search: ' | from read_ssa_enriched_events()
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
   cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
   "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
-  "string", null) | where cmd_line != null AND process_name != null AND process_path
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null AND process_path
   != null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path,
   /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
index 48c1461954..af0ac5c771 100644
--- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
+++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
@@ -14,13 +14,14 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line,
   /(?i)\-dbpath[\s;:\.\|]+/)=true
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
index c71ec2c27c..c9b4b4bae5 100644
--- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
+++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
@@ -13,12 +13,13 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
index 359a6bf3f2..7ff9e8d432 100644
--- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
@@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line,
   /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR
   match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true
@@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
index 6506854263..9e99b35eea 100644
--- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
+++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
@@ -15,7 +15,8 @@ search: ' | from read_ssa_enriched_events()
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
   cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
   "process_name"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line != null AND parent_process_name
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND parent_process_name
   != null AND process_name != null  AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true
   OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name,
   /(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line,
@@ -23,7 +24,7 @@ search: ' | from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
index cc5703d472..a093482048 100644
--- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
+++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
@@ -14,13 +14,14 @@ search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
   cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
-  "process_name"), "string", null) | where cmd_line != null AND process_name != null
+  "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null
   AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name,
   /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
index 675c82db87..7925a12426 100644
--- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
@@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line,
   /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true
   OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true
@@ -23,7 +24,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index 4944e530e8..9c586b43cb 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -17,10 +17,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: o successfully implement this search, you need to be ingesting logs
diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 7ffd71808b..929e0a581e 100644
--- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
   process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND match_regex(cmd_line,
   /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 4f39782191..442e1b5e93 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -11,10 +11,11 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
   "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
   "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
-  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) |
-  where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
+  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
-  body=create_map(["process_name", process_name]) | into write_ssa_detected_events();'
+  body=create_map(["event_id", event_id, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
   Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml
index 28769faa1e..289d3c7f93 100644
--- a/detections/endpoint/ssa___detect_kerberoasting.yml
+++ b/detections/endpoint/ssa___detect_kerberoasting.yml
@@ -12,11 +12,12 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_
   "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
   ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
   "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
-  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
+  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
   | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
   | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
   | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
-  | eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode,
+  | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, "EventCode", EventCode,
   "ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType",
   TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, "dest_user_id"),
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))|
diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml
index 307126de72..577b2cc63b 100644
--- a/detections/endpoint/ssa___detect_pass_hash.yml
+++ b/detections/endpoint/ssa___detect_pass_hash.yml
@@ -14,13 +14,13 @@ search: ' | from read_ssa_enriched_events()
   "authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
   origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
   "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null)
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
 
   | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
   AND authentication_method="seclogo")
 
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method",
+  dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, "authentication_method",
   authentication_method]) | into write_ssa_detected_events();'
 how_to_implement: The test data is converted from Windows Security Event logs generated
   from Attach Range simulation and used in SPL search and extended to SPL2
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index f03182c18e..4c246eb583 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
index 5caccee87b..404de307bd 100644
--- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml
+++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
@@ -18,11 +18,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
   */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
   /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
-  /\d+/, "N") | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string",
+  /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string",
   ""), /.* \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp,
   dest_device_id, dest_user_id | first_time_event input_columns=["cmd_line_norm"]
   | where first_time_cmd_line_norm | eval start_time = timestamp, end_time = timestamp,
-  entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line",
+  entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line",
   cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be populating the endpoint data model for SSA and specifically
   the process_name and the process fields
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index bf7c627d5d..a77ba359a3 100644
--- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
   process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND match_regex(cmd_line,
   /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR
   process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
index 8b1638b8d0..218254c0fd 100644
--- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line,
   /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true
   OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line,
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
index a45ecf3e7c..a782f1c1fc 100644
--- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
@@ -10,12 +10,13 @@ description: This detection identifies access to PowerSploit modules that create
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
index c7b05abca5..538e8074b5 100644
--- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
@@ -10,13 +10,14 @@ description: This detection identifies use of DSInternals modules that enable or
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line,
   /(?i)Enable-ADDBAccount/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
index 85042ce830..ad659cfd74 100644
--- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
@@ -10,13 +10,14 @@ description: This detection identifies access to PowerSploit modules that delete
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line,
   /(?i)event::clear/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
index 3223882d07..79f2e0bf88 100644
--- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
@@ -11,14 +11,15 @@ description: This detection identifies use of DSInternals modules for illegal ma
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line,
   /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true
   OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
index 265178ec0a..a7d4a14e00 100644
--- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line,
   /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true
   OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
index 638ac2099c..b567736542 100644
--- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that illega
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line,
   /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true
   OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line,
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
index 72a48575e4..d836f33fae 100644
--- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for illegal privi
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line,
   /(?i)token::elevate/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
index 920c2c3087..c78584412a 100644
--- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
@@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for illegal contr
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line,
   /(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line,
   /(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
index c224d0baa0..dea1a11cf1 100644
--- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
@@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules that enable
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line,
   /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true
   OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line,
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index f7b836ec70..21a7504175 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -16,12 +16,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
   process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line,
   "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line,
   /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe"
   OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
index 8e07b350a2..61d60c2d29 100644
--- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
@@ -10,14 +10,15 @@ description: This detection identifies use of PowerSploit modules that facilitat
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line,
   /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true
   )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 24da4393a2..4024d25afb 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events()
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
   null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
-  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
 
   | where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
   | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
@@ -24,7 +25,7 @@ search: '| from read_ssa_enriched_events()
   OR field0="java.exe" OR field0="powershell.exe"
 
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
+  dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name, "parent_process_name",
   parent_process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon logs. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
index 6567d28163..487e7428cb 100644
--- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
   null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
   "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null) | where parent_process_name!=null | select parent_process_name,
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where parent_process_name!=null | select parent_process_name,
   process_name, cmd_line, timestamp, dest_device_id, dest_user_id | conditional_anomaly
   conditional="parent_process_name" target="process_name" | where (process_name="powershell.exe"
   OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe"
diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
index 537fdf3391..d5f854400d 100644
--- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
@@ -13,7 +13,8 @@ description: This detection identifies use of PowerSploit modules that discover
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line,
   /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true
   OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line,
@@ -28,7 +29,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
index cfcb63b207..f16e440bb5 100644
--- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line,
   /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true
   OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line,
@@ -37,7 +38,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
index 40fa43524e..51bc90560a 100644
--- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery of
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line,
   /(?i)net::group/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
index ca03e6dcc1..9c06003b17 100644
--- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
@@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules for reconna
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line,
   /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line,
   /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
index 86bcac8aae..f88086142c 100644
--- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line,
   /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line,
   /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
index 49611352d8..674e4152bb 100644
--- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
@@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery of
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
index 1be62676ca..17ab43d50c 100644
--- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line,
   /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true
   OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true
@@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
index 0638c05c09..8549289d24 100644
--- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
@@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery and
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)net::share/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
index fed9e72691..978a6f90a1 100644
--- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line,
   /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true
   OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line,
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
index 59c8c479dd..31d805f057 100644
--- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules for reconna
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line,
   /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true
   OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
@@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
index a325b9efbd..ef7b455b8e 100644
--- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
@@ -10,7 +10,8 @@ description: This detection identifies reconnaissance of credential stores and u
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line,
   /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR
   match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true
@@ -18,7 +19,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
index b865a0e502..4eda5ced21 100644
--- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
@@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
index 67a0ef44e8..abda4d98af 100644
--- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
@@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
index c87e6d919d..c0b15e5c55 100644
--- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
@@ -14,12 +14,13 @@ description: This detection identifies use of Mimikatz modules for discovery of
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
index 3b849f17e0..8d68076c93 100644
--- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery and
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line,
   /(?i)service::list/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index de8bf510b9..024367928b 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -17,11 +17,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line,
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line,
   "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe"
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
index f46b03d47f..588d0c4a14 100644
--- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
@@ -13,7 +13,8 @@ search: '| from read_ssa_enriched_events()
   process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
   "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
   OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
   OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
   /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
@@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
index 3eb0dff00f..94cd51b1e1 100644
--- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
@@ -10,13 +10,14 @@ description: This detection identifies illegal setting of credentials via Mimika
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line,
   /(?i)CRYPTO::scauth/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
index 04eb74c964..2f8939eec5 100644
--- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
@@ -10,12 +10,13 @@ description: This detection identifies illegal setting of credentials via PowerS
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true )
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
index 8f412ef4fb..8029f145fb 100644
--- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml
+++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
@@ -16,7 +16,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
   null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
-  null));
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
   $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
   OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
@@ -226,7 +226,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
   union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
   AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
-  end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path",
+  end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
   process_path, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: None
diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml
index 23f4dba53f..73a239a755 100644
--- a/detections/endpoint/ssa___unusually_long_command_line.yml
+++ b/detections/endpoint/ssa___unusually_long_command_line.yml
@@ -13,7 +13,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
   "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
   null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
-  process_name=ucast(map_get(input_event, "process_name"), "string", null) | where
+  process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line!=null and dest_user_id!=null | eval cmd_line_norm=replace(cast(cmd_line,
   "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/,
   "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
@@ -21,7 +22,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
   | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
   "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
-  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line",
+  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line",
   cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon endpoint data that monitors command
   lines.
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index cf1c1c86ba..54c3650609 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -13,14 +13,15 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
   process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line,
   "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line,
   /(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line,
   /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line,
   /(?i)powershell/)=true) AND process_name="wevtutil.exe" | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name",
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name",
   parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index 855fa2ccdc..20af445965 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -13,11 +13,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
   process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line,
   "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" | eval
   start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
   "parent_process_name", parent_process_name, "process_path", process_path]) | into
   write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
index 11cec34fd4..1532a647be 100644
--- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
+++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
@@ -25,10 +25,28 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$
+    with EventCode $EventCode$
   mitre_attack_id:
   - T1548.002
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -43,23 +61,5 @@ tags:
   - Computer
   - EventCode
   - Company
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
   risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$
-    with EventCode $EventCode$
-  observable:
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+  security_domain: endpoint
diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index f527f9de21..5d2ab46587 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious modification of registry related to UAC bypass. 
-  This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to 
-  bypass User account Control.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute")
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `wsreset_uac_bypass_filter`'
+description: This search is to detect a suspicious modification of registry related
+  to UAC bypass. This technique is to modify the registry in this detection, create
+  a registry value with the path of the payload and run WSreset.exe to bypass User
+  account Control.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*"
+  (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute")
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -27,10 +27,27 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  impact: 70
   kill_chain_phases:
   - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
   mitre_attack_id:
   - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -40,23 +57,6 @@ tags:
   - Registry.registry_path
   - Registry.registry_key_name
   - Registry.registry_value_name
-  - Registry.dest 
-  security_domain: endpoint
-  impact: 70
-  confidence: 90 
-  # (impact * confidence)/100
+  - Registry.dest
   risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  security_domain: endpoint
diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index 9beb9d621a..2776d6dcb4 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.25.2"
+      "version": "3.26.0"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf
index 8d1d346f03..ff70301e35 100644
--- a/dist/escu/default/analytic_stories.conf
+++ b/dist/escu/default/analytic_stories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:21 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -377,7 +377,7 @@ modification_date = 2020-02-04
 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a
 version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
-detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
+detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
 investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 support_searches = []
@@ -476,7 +476,7 @@ modification_date = 2020-10-21
 id = 66b0fe0c-1351-11eb-adc1-0242ac120002
 version = 1
 reference = ["https://attack.mitre.org/tactics/TA0010/"]
-detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"]
+detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1273,7 +1273,7 @@ modification_date = 2020-08-25
 id = 8168ca88-392e-42f4-85a2-767579c660ce
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"]
+detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"]
@@ -1689,7 +1689,7 @@ modification_date = 2018-05-31
 id = 56e24a28-5003-4047-b2db-e8f3c4618064
 version = 1
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
-detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
+detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index ad16c04056..bb9d1d57fb 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:20 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -263,7 +263,7 @@ version = 3
 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
+searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 narrative = Credential dumping&#151;gathering credentials from a target system, often hashed or encrypted&#151;is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
 Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\
@@ -332,7 +332,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0010/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
 description = The stealing of data by an adversary.
 narrative = Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command and Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.
 
@@ -883,7 +883,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
 
@@ -1060,7 +1060,7 @@ version = 1
 references = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"]
 maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"]
+searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
 narrative = trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data.
 
@@ -1142,7 +1142,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
@@ -2363,6 +2363,18 @@ annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = None thus far found
 providing_technologies = []
 
+[savedsearch://ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]}
+known_false_positives = Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
+providing_technologies = []
+
 [savedsearch://ESCU - Detect Credential Dumping through LSASS access - Rule]
 type = detection
 asset_type = Windows
@@ -2938,7 +2950,7 @@ asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 known_false_positives = None
 providing_technologies = []
 
@@ -3163,6 +3175,16 @@ annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Comman
 known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives.
 providing_technologies = []
 
+[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+providing_technologies = []
+
 [savedsearch://ESCU - Detect web traffic to dynamic domain providers - Rule]
 type = detection
 asset_type = Endpoint
@@ -4283,6 +4305,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["
 known_false_positives = None at this time
 providing_technologies = []
 
+[savedsearch://ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]}
+known_false_positives = limitted. this anomaly behavior is not commonly seen in clean host.
+providing_technologies = []
+
 [savedsearch://ESCU - Msmpeng Application DLL Side Loading - Rule]
 type = detection
 asset_type = 
@@ -4417,6 +4449,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.00
 known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
 providing_technologies = []
 
+[savedsearch://ESCU - NET Profiler UAC bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = limited false positive. It may trigger by some windows update that will modify this registry.
+providing_technologies = []
+
 [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule]
 type = detection
 asset_type = Endpoint
@@ -4619,6 +4661,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.00
 known_false_positives = default browser not in the filter list
 providing_technologies = []
 
+[savedsearch://ESCU - Office Product Spawn CMD Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]}
+known_false_positives = IT or network admin may create an document automation that will run shell script.
+providing_technologies = []
+
 [savedsearch://ESCU - Office Product Spawning BITSAdmin - Rule]
 type = detection
 asset_type = 
@@ -5234,6 +5286,16 @@ annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre
 known_false_positives = Limited to no known false positives.
 providing_technologies = []
 
+[savedsearch://ESCU - SAM Database File Access Attempt - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]}
+known_false_positives = Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+providing_technologies = []
+
 [savedsearch://ESCU - SLUI RunAs Elevated - Rule]
 type = detection
 asset_type = 
@@ -5387,6 +5449,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
 providing_technologies = []
 
+[savedsearch://ESCU - Sdclt UAC Bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = Limited to no false positives are expected.
+providing_technologies = []
+
 [savedsearch://ESCU - SearchProtocolHost with no Command Line with Network - Rule]
 type = detection
 asset_type = 
@@ -5457,6 +5529,16 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1136.001"], "nist": ["PR.
 known_false_positives = It is possible that an administrator created and deleted an account in a short time period.  Verifying activity with an administrator is advised.
 providing_technologies = []
 
+[savedsearch://ESCU - SilentCleanup UAC Bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Single Letter Process On Endpoint - Rule]
 type = detection
 asset_type = Endpoint
@@ -5955,6 +6037,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - UAC Bypass MMC Load Unsigned Dll - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
+providing_technologies = []
+
 [savedsearch://ESCU - USN Journal Deletion - Rule]
 type = detection
 asset_type = Endpoint
@@ -6122,6 +6214,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events.
 providing_technologies = []
 
+[savedsearch://ESCU - WSReset UAC Bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Wbemprox COM Object Execution - Rule]
 type = detection
 asset_type = 
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 0c4dc531e1..0143fd84da 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 34790
+build = 35236
 
 [triggers]
 reload.analytic_stories = simple
@@ -19,7 +19,7 @@ reload.content-version = simple
 
 [launcher]
 author = Splunk
-version = 3.25.2
+version = 3.26.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index 1995e14408..2d8a2f162a 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:20 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index 0f980de608..41a20abb26 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.25.2
+version = 3.26.0
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index e1198476ff..1a2ffd00c4 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:21 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -2311,6 +2311,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[sam_database_file_access_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [slui_runas_elevated_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index 805608d3f3..74aee828c5 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:20 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -26,9 +26,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -200,11 +197,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = User $user$ created a policy version that allows them to access any resource in their account
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -242,11 +236,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -284,11 +275,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$
-action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -326,9 +314,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time.
 action.risk.param._risk = [{"threat_object_field": "requestingAccountId", "threat_object_type": "other"}, {"threat_object_field": "requestedAccountId", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
@@ -368,11 +353,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware Cloud"]
 action.risk = 1
-action.risk.param._risk_object = userIdentity.principalId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts.
-action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -410,11 +392,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware Cloud"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"threat_object_field": "dest_file", "threat_object_type": "file"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"threat_object_field": "dest_file", "threat_object_type": "file"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -492,11 +471,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50,  using the following commands $command$.
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -534,11 +510,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = userIdentity.arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
-action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -576,11 +549,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 28
 action.risk.param._risk_message = User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name.
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 28}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -618,11 +588,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 10}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -660,11 +627,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = group_name
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = User $user_arn$ has had mulitple failures while attempting to delete groups from $src$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_name", "risk_object_type": "user", "risk_score": 5}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -702,11 +666,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = group_deleted
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_deleted", "risk_object_type": "user", "risk_score": 5}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -744,11 +705,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
-action.risk.param._risk_object = requestParameters.cidrBlock
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "requestParameters.cidrBlock", "risk_object_type": "system", "risk_score": 48}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -786,11 +744,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -828,11 +783,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = sourceIPAddress
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$
-action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}]
+action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -870,11 +822,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = userIdentity.principalId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$
-action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -912,11 +861,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -954,11 +900,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -996,9 +939,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -1043,9 +983,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -1172,11 +1109,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1214,9 +1148,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -1256,9 +1187,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -1298,11 +1226,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1340,11 +1265,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "TargetImage", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1388,11 +1310,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 5}, {"threat_object_field": "process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1477,11 +1396,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 3
 action.risk.param._risk_message = Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 3}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 3}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1525,11 +1441,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 3
 action.risk.param._risk_message = Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 3}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 3}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1613,11 +1526,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1741,11 +1651,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike", "NOBELIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1789,11 +1696,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell", "Ingress Tool Transfer"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1837,11 +1741,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1885,11 +1786,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1933,11 +1831,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Disabling Security Tools"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1981,11 +1876,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Disabling Security Tools", "Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 20
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 20}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2029,11 +1921,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2077,11 +1966,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2125,11 +2011,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["BITS Jobs"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2173,11 +2056,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2221,11 +2101,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["SamSam Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2269,11 +2146,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2317,11 +2191,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2364,11 +2235,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2412,11 +2280,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2460,11 +2325,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Deobfuscate-Decode Files or Information"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2508,11 +2370,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2597,11 +2456,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2688,11 +2544,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 100
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2736,11 +2589,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 100
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2783,18 +2633,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -2825,11 +2672,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2867,11 +2711,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2909,11 +2750,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2951,18 +2789,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -2993,11 +2828,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3077,11 +2909,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3120,11 +2949,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = object
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3163,11 +2989,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = object_id
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object_id", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3206,11 +3029,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = object
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3250,11 +3070,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3303,11 +3120,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3351,11 +3165,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3399,11 +3210,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3447,11 +3255,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated.
-action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "other"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3495,9 +3300,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation.
 action.risk.param._risk = [{"threat_object_field": "Service_File_Name", "threat_object_type": "other"}, {"threat_object_field": "Service_Name", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
@@ -3543,11 +3345,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DHS Report TA18-074A"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3591,11 +3390,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Hidden Cobra Malware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3639,11 +3435,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3687,11 +3480,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3735,11 +3525,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3783,11 +3570,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3831,11 +3615,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3879,11 +3660,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -3927,11 +3705,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4013,8 +3788,8 @@ action.escu.data_models = ["Network_Resolution"]
 action.escu.eli5 = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
 action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
 action.escu.known_false_positives = It's possible there can be long domain names that are legitimate.
-action.escu.creation_date = 2021-01-18
-action.escu.modification_date = 2021-01-18
+action.escu.creation_date = 2021-07-21
+action.escu.modification_date = 2021-07-21
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviation - Rule
 action.escu.search_type = detection
@@ -4022,11 +3797,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
-action.risk.param._risk_object = host
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A dns query $query$ with 2 time standard deviation of name len of the dns query in host  $host$
-action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}]
+action.risk.param._risk = [{"threat_object_field": "query", "threat_object_type": "dnsquery"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4049,7 +3821,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query |  `drop_dm_object_name("DNS")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` 
+search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` 
 
 [ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule]
 action.escu = 0
@@ -4165,11 +3937,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Domain Trust Discovery"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4218,11 +3987,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$.
-action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4265,11 +4031,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4313,11 +4076,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4367,9 +4127,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -4462,9 +4219,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -4510,11 +4264,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4552,11 +4303,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4594,11 +4342,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4636,11 +4381,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4678,11 +4420,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Lateral Movement"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "EventCode", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4726,11 +4465,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Discovery Techniques"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4774,11 +4510,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Discovery Techniques"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4942,11 +4675,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Detect Zerologon Attack"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "EventCode", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -4994,11 +4724,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5043,11 +4770,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated.
-action.risk.param._risk = [{"threat_object_field": "source_image", "threat_object_type": "other"}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetImage", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "source_image", "threat_object_type": "other"}, {"threat_object_field": "TargetImage", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5140,11 +4864,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$.
-action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5193,11 +4914,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Account Monitoring and Controls"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = Multiple accounts have been locked out. Review $dest$ and results related to $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5241,11 +4959,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Account Monitoring and Controls"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"threat_object_field": "result", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "result", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5289,11 +5004,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5417,11 +5129,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5465,11 +5174,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5513,11 +5219,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5561,11 +5264,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5730,11 +5430,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious MSHTA Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5778,11 +5475,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "ImageLoaded", "threat_object_type": "parent process"}, {"threat_object_field": "Image", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "parent process"}, {"threat_object_field": "Image", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5870,11 +5564,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$.
-action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 90}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -5919,11 +5610,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6049,18 +5737,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
-action.risk.param._risk_object = userName
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
-action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
-action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
+action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
+action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -6071,7 +5756,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 
+search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 
 
 [ESCU - Detect New Open S3 buckets - Rule]
 action.escu = 0
@@ -6091,18 +5776,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
-action.risk.param._risk_object = userName
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
-action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$
-action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
+action.risk.param._risk_message = User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$
+action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect New Open S3 buckets - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -6113,7 +5795,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` 
+search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` 
 
 [ESCU - Detect Outbound SMB Traffic - Rule]
 action.escu = 0
@@ -6214,11 +5896,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6302,11 +5981,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6350,11 +6026,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6398,11 +6071,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6487,11 +6157,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6535,11 +6202,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6583,11 +6247,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6631,11 +6292,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6679,11 +6337,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6727,11 +6382,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6777,11 +6429,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6826,11 +6475,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 27
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6874,11 +6520,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 27
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6922,11 +6565,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 27
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -6970,11 +6610,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 27
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7059,11 +6696,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7107,11 +6741,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7155,11 +6786,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7203,11 +6831,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Suspicious rundll32.exe inline HTA execution on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7251,9 +6876,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -7338,11 +6960,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Discovery Techniques", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 24
 action.risk.param._risk_message = Possible SharpHound command-Line arguments identified on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7386,11 +7005,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Discovery Techniques", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 24
 action.risk.param._risk_message = Potential SharpHound file modifications identified on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 24}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7434,11 +7050,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Discovery Techniques", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 24
 action.risk.param._risk_message = Potential SharpHound binary identified on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -7529,9 +7142,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -7563,7 +7173,7 @@ search = `cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApi
 action.escu = 0
 action.escu.enabled = 1
 description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
-action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 action.escu.data_models = []
 action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
@@ -7577,10 +7187,7 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Security Hub Alerts"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 20
-action.risk.param._risk_message = 
+action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
 action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -7588,7 +7195,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
-action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -7660,9 +7267,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 20
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -7708,9 +7312,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -7756,9 +7357,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -7804,9 +7402,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 20
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -7972,11 +7567,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Command-Line Executions"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = cmd.exe launching script interpreters on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -8030,11 +7622,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Possible malicious WMI Subscription created on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -8249,11 +7838,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"]
 action.risk = 1
-action.risk.param._risk_object = host
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A dns query $query$ from your infra connecting to suspicious domain in host  $host$
-action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}]
+action.risk.param._risk = [{"threat_object_field": "query", "threat_object_type": "dnsquery"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -8337,11 +7923,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious MSHTA Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -8385,11 +7968,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious MSHTA Activity"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -8433,9 +8013,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -8522,11 +8099,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Unusual Processes"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 32
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 32}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -8550,7 +8124,46 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`
+search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`
+
+[ESCU - Detect shared ec2 snapshot - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+action.escu.creation_date = 2021-07-20
+action.escu.modification_date = 2021-07-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect shared ec2 snapshot - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"]
+action.risk = 1
+action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$
+action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect shared ec2 snapshot - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Exfiltration"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` 
 
 [ESCU - Detect shared ec2 snapshot - Rule]
 action.escu = 0
@@ -8819,11 +8432,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 24
 action.risk.param._risk_message = WevtUtil.exe used to disable Event Logging on $dest
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -8867,9 +8477,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = Disabled Registry Tools
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -8915,9 +8522,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = Disabled 'Show Hidden Files'
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -8963,9 +8567,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = Disabled 'Windows App Hotkeys'
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -9011,11 +8612,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = Windows Defender real time behavior monitoring disabled on $dest
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9059,11 +8657,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = The Windows Smartscreen was disabled on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9107,11 +8702,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = The Windows command prompt was disabled on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9155,11 +8747,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = The Windows Control Panel was disabled on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9203,11 +8792,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = The Windows Firewall was disabled on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9251,11 +8837,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9299,11 +8882,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9347,11 +8927,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = The Windows registry was modified to disable run application in window start menu on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9395,11 +8972,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9443,11 +9017,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = The Windows registry was modified to disable system restore on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9491,11 +9062,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = The Windows Task Manager was disabled on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9539,11 +9107,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Suspicious files were downloaded with the Telegram application on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9586,11 +9151,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9636,11 +9198,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9687,11 +9246,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -9736,9 +9292,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Unusual AWS EC2 Modifications"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -9784,9 +9337,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -10076,11 +9626,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = RDP was moved to a non-standard port on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10124,11 +9671,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10171,11 +9715,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10219,11 +9760,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10267,11 +9805,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10315,11 +9850,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10403,11 +9935,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10451,11 +9980,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10499,11 +10025,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 28
 action.risk.param._risk_message = Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10587,11 +10110,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 28
 action.risk.param._risk_message = Excessive usage  of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10635,11 +10155,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 28
 action.risk.param._risk_message = Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 28}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10682,11 +10199,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["meterpreter"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10730,11 +10244,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10778,11 +10289,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Meterpreter"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10826,11 +10334,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10874,11 +10379,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -10963,11 +10465,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = process $process$ have double extensions in the file name is executed on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11052,11 +10551,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_id", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11100,11 +10596,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["SamSam Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 90
 action.risk.param._risk_message = File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "file_name", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11148,11 +10641,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11285,11 +10775,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11579,11 +11066,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = connection_to_CNC
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = Process gpupdate.exe  with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"risk_object_field": "connection_to_CNC", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11627,11 +11111,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "registry_value_name", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "registry_value_name", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11675,11 +11156,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11723,11 +11201,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = High frequency file deletion activity detected on host $Computer$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "deleted_files", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "deleted_files", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11812,11 +11287,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = High frequency process termination (more than 15 processes within 3s) detected on host $Computer$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "proc_terminated", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "proc_terminated", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11899,11 +11371,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -11947,11 +11416,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -12035,11 +11501,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Lateral Movement"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Potential kerberoasting attack via service principal name requests detected on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -12082,11 +11545,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Known services $Message$ terminated by a potential ransomware on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "Message", "threat_object_type": "other"}]
+action.risk.param._risk = [{"threat_object_field": "Message", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -12978,11 +12438,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13025,11 +12482,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"threat_object_field": "process", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13073,11 +12527,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell", "NOBELIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Powershell.exe running potentially malicious encodede commands on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13121,11 +12572,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = PowerShell local execution policy bypass attempt on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13210,11 +12658,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = Powershell.exe running with potential obfuscated arguments on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13258,11 +12703,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious Powershell"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13306,11 +12748,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 54
 action.risk.param._risk_message = Wallpaper modification on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13353,11 +12792,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 32
 action.risk.param._risk_message = Suspicious ACL permission modification on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13481,11 +12917,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = New print monitor added on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13570,11 +13003,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13659,9 +13089,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Command and Control", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$
 action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}]
 action.risk.param.verbose = 0
@@ -13712,11 +13139,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = Client_Address
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$
-action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13768,11 +13192,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = Client_Address
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$
-action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13824,11 +13245,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = Source_Workstation
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$
-action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13920,11 +13338,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential password spraying attack from $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -13976,11 +13391,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = Client_Address
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$
-action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14032,11 +13444,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = Source_Workstation
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$
-action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14088,11 +13497,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential password spraying attack from $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14144,11 +13550,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Potential password spraying attack on $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14194,11 +13597,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14242,11 +13642,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = Domain trust discovery execution on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14331,11 +13728,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14424,11 +13818,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 50
 action.risk.param._risk_message = Active Directory NTDS export on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 50}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14474,11 +13865,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$
-action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14516,11 +13904,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = Target.ID
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$
-action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Target.ID", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14558,11 +13943,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user_id
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA
-action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14600,11 +13982,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14642,11 +14021,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$.
-action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14684,11 +14060,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = UserId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$.
-action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14726,11 +14099,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = UserId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$
-action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14768,11 +14138,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = Source
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$
-action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}, {"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14810,11 +14177,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14852,11 +14216,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14894,11 +14255,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = ForwardingSmtpAddress
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "ForwardingSmtpAddress", "risk_object_type": "user", "risk_score": 48}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14936,11 +14294,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Office application spawning rundll32.exe on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -14984,11 +14339,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Office document creating a schedule task on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15031,11 +14383,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Office document executing a macro on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15078,11 +14427,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Office document spawning suspicious child process on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15125,11 +14471,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15173,11 +14516,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15221,11 +14561,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15269,11 +14606,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15317,11 +14651,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15365,11 +14696,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process_name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15614,11 +14942,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = A suspicious file modification or replace in $file_path$  in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "file_path", "threat_object_type": "file_path"}]
+action.risk.param._risk = [{"threat_object_field": "file_path", "threat_object_type": "file_path"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15662,11 +14987,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15710,9 +15032,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Command and Control", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$
 action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}]
 action.risk.param.verbose = 0
@@ -15761,11 +15080,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15814,11 +15130,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A suspicious powershell script contains reflective class assembly  command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15863,11 +15176,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["BITS Jobs"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -15911,11 +15221,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16045,11 +15352,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 48}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16101,11 +15405,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16151,11 +15452,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16198,11 +15496,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16245,11 +15540,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16292,11 +15584,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16344,11 +15633,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Suspicious print driver was loaded on endpoint $ComputerName$.
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 72}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16399,11 +15685,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$.
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 72}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16449,11 +15732,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A process $process_name$ that launching .lnk file in $file_path$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16497,11 +15777,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 60
 action.risk.param._risk_message = A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16545,11 +15822,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16593,11 +15867,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16722,11 +15993,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16932,11 +16200,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware", "DarkSide Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 81
 action.risk.param._risk_message = A high frequency file creation of $file_name$ in different file path in host $Computer$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -16979,11 +16244,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17026,11 +16288,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 60
 action.risk.param._risk_message = A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 60}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17114,11 +16373,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 45
 action.risk.param._risk_message = A reg.exe process $process_name$ with commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 45}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17203,11 +16459,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware  DHS Report TA18-201A "]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 76
 action.risk.param._risk_message = A registry activity in $registry_path$ related to persistence in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17251,11 +16504,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 76
 action.risk.param._risk_message = A registry activity in $registry_path$ related to privilege escalation in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17299,11 +16549,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A registry activity in $registry_path$ related to shim modication in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17470,11 +16717,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware", "Suspicious WMI Use"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17559,11 +16803,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = A wmic.exe process $process$ contain node commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17607,11 +16848,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17655,11 +16893,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 54
 action.risk.param._risk_message = A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 54}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17703,11 +16938,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 60
 action.risk.param._risk_message = A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17751,11 +16983,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Unusual Processes"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17799,11 +17028,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "processname"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17847,11 +17073,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ryuk Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = A creation of ryuk test file $file_path$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17894,11 +17117,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ryuk Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A process $process_name$ with wake on LAN commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17924,6 +17144,51 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*8 LAN*" OR Processes.process="*9 REP*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`
 
+[ESCU - SAM Database File Access Attempt - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+action.escu.how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+action.escu.known_false_positives = Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+action.escu.creation_date = 2021-07-23
+action.escu.modification_date = 2021-07-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - SAM Database File Access Attempt - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Credential Dumping"]
+action.risk = 1
+action.risk.param._risk_message = The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$.
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}, {"threat_object_field": "Object_Name", "threat_object_type": "file"}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - SAM Database File Access Attempt - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}, {"name": "Object_Name", "role": ["Other"], "type": "File"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+action.notable.param.rule_title = SAM Database File Access Attempt
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") | stats values(Accesses) count by process_name Object_Name  dest user | `sam_database_file_access_attempt_filter`
+
 [ESCU - SLUI RunAs Elevated - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -17942,11 +17207,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A slui process $process_name$ with elevated commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -17990,11 +17252,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18164,11 +17423,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["SamSam Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 12
 action.risk.param._risk_message = A samsam ransomware test file creation in $file_path$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 12}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18212,11 +17468,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18260,11 +17513,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}]
+action.risk.param._risk = [{"threat_object_field": "Arguments", "threat_object_type": "arguments"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18307,11 +17557,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}]
+action.risk.param._risk = [{"threat_object_field": "Arguments", "threat_object_type": "arguments"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18354,11 +17601,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18443,11 +17687,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = A "on demand" execution of schedule task process $process_name$  using commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18491,11 +17732,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Lateral Movement", "NOBELIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = Processes.user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A schedule task process $process_name$ with remote job commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18539,11 +17777,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18587,11 +17822,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = A wmic.exe process $process_name$ taht execute script in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18635,11 +17867,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18683,11 +17912,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "processname"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18731,11 +17957,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18779,11 +18002,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = Processes.user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 76
 action.risk.param._risk_message = A service process $parent_process_name$ with process path $process_path$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 76}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18827,11 +18047,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "registry_path", "threat_object_type": "registrypath"}]
+action.risk.param._risk = [{"threat_object_field": "registry_path", "threat_object_type": "registrypath"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18875,11 +18092,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = A process that possibly write shim database in $file_path$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "file_path", "threat_object_type": "file path"}]
+action.risk.param._risk = [{"threat_object_field": "file_path", "threat_object_type": "file path"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18923,11 +18137,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A process $process_name$ that possible create a shim db silently in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -18971,11 +18182,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Account Monitoring and Controls"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A user account created or delete shortly in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19019,11 +18227,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19067,11 +18272,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["DHS Report TA18-074A"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = A suspicious process $process_name$ with single letter in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19237,11 +18439,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}, {"threat_object_field": "process_id", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process_id", "threat_object_type": "process"}, {"threat_object_field": "process_id", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19285,11 +18484,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare.
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process name"}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file"}]
+action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process name"}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19332,11 +18528,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare.
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "ProcessID", "threat_object_type": "process"}, {"threat_object_field": "TargetImage", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "ProcessID", "threat_object_type": "process"}, {"threat_object_field": "TargetImage", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19379,11 +18572,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}]
+action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19427,11 +18617,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}]
+action.risk.param._risk = [{"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19474,9 +18661,6 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -19686,11 +18870,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19734,11 +18915,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious driver $ImageLoaded$ on $Computer$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19864,11 +19042,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 9
 action.risk.param._risk_message = The Windows Event Log Service shutdown on $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 9}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -19953,11 +19128,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20042,11 +19214,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20090,11 +19259,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = Suspicious msbuild.exe process executed on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20261,11 +19427,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20309,11 +19472,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20357,11 +19517,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Regsvr32 Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20405,11 +19562,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious renamed rundll32.exe binary ran on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20453,11 +19607,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = rundll32.exe running with suspicious parameters on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20501,11 +19652,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = $Processes.process_path.file_path$ process potentially loading malicious code
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
+action.risk.param._risk = [{"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20549,11 +19697,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20638,11 +19783,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Suspicious scheduled task registered on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20686,11 +19828,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20734,11 +19873,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20782,11 +19918,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20830,11 +19963,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20878,11 +20008,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious MSHTA Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = suspicious mshta child process detected on host $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process", "threat_object_type": "process name"}]
+action.risk.param._risk = [{"threat_object_field": "parent_process", "threat_object_type": "process name"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20926,11 +20053,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious MSHTA Activity"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = mshta.exe spawned by wmiprvse.exe on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -20974,11 +20098,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 28
 action.risk.param._risk_message = Wevtutil.exe being used to clear Event Logs on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 28}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21062,11 +20183,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 28
 action.risk.param._risk_message = Suspicious writes to windows Recycle Bin process $Processes.process_name$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "Processes.process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21110,11 +20228,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Discovery Techniques"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = Potential system information discovery behavior on $dest$ by $User$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21162,11 +20277,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = System process running from unexpected location on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "Processes.process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21252,11 +20364,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = Possible Trickbot namedpipe created on $Computer$ by $Image$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Image", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "Image", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21299,11 +20408,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21346,11 +20452,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 45
 action.risk.param._risk_message = Possible USN journal deletion on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21435,11 +20538,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Possible CVE-2021-26857 exploitation on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21483,11 +20583,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Disabling Security Tools"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 45
 action.risk.param._risk_message = Possible Sysmon filter driver unloading on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21535,11 +20632,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21665,11 +20759,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = Unusually long command line $Processes.process_name$ on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "Processes.process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21794,11 +20885,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["HAFNIUM Group"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Possible Web Shell execution on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21842,11 +20930,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = System backups deletion on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21941,11 +21026,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = User $user$ on $host$ executed the following suspicious WMI query: $Query$.  Filter: $filter$. Consumer: $Consumer$.  EventCode: $EventCode$
-action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -21994,11 +21076,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_object = User
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22081,11 +21160,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22129,11 +21205,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 35
 action.risk.param._risk_message = Suspicious COM Object Execution on $Computer$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 35}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22339,11 +21412,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = ComputerName
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Wermgr.exe process connecting IP location web services on $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22386,11 +21456,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Wermgr.exe writing executable files on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22434,11 +21501,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 56
 action.risk.param._risk_message = Wermgr.exe spawning suspicious processes on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22490,11 +21554,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}]
+action.risk.param._risk = [{"threat_object_field": "Command", "threat_object_type": "command"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22549,11 +21610,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}]
+action.risk.param._risk = [{"threat_object_field": "Command", "threat_object_type": "command"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22682,11 +21740,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ryuk Ransomware", "Windows Defense Evasion Tactics"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 24
 action.risk.param._risk_message = Windows DisableAntiSpyware registry key set to 'disabled' on $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22730,11 +21785,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = Windows event logs cleared on $dest$ via EventCode $EventCode$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22778,11 +21830,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ryuk Ransomware"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22907,11 +21956,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -22955,11 +22001,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -23003,11 +22046,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Spearphishing Attachment"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -23051,11 +22091,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 70
 action.risk.param._risk_message = $user$ dropped or created an executable file in known sensitive SMB share.  Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
+action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -23099,11 +22136,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
-action.risk.param._risk_object = Computer
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 80
 action.risk.param._risk_message = A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$
-action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "imageloaded"}]
+action.risk.param._risk = [{"threat_object_field": "ImageLoaded", "threat_object_type": "imageloaded"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 20f21490a1..d86c626720 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:20 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf
index 106a862816..345dbf5ea4 100644
--- a/dist/escu/default/use_case_library.conf
+++ b/dist/escu/default/use_case_library.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:21 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -263,7 +263,7 @@ version = 3
 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
+searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 narrative = Credential dumping&#151;gathering credentials from a target system, often hashed or encrypted&#151;is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
 Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\
@@ -332,7 +332,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0010/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
 description = The stealing of data by an adversary.
 narrative = Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command and Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.
 
@@ -883,7 +883,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
 
@@ -1167,7 +1167,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
@@ -2975,7 +2975,7 @@ asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 known_false_positives = None
 providing_technologies = []
 
@@ -5311,6 +5311,16 @@ annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre
 known_false_positives = Limited to no known false positives.
 providing_technologies = []
 
+[savedsearch://ESCU - SAM Database File Access Attempt - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]}
+known_false_positives = Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+providing_technologies = []
+
 [savedsearch://ESCU - SLUI RunAs Elevated - Rule]
 type = detection
 asset_type = 
diff --git a/dist/saaws/app.manifest b/dist/saaws/app.manifest
index 548392a458..1877128770 100644
--- a/dist/saaws/app.manifest
+++ b/dist/saaws/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS_AmazonWebServices_Content", 
-      "version": "3.25.2"
+      "version": "3.26.0"
     }, 
     "author": [
       {
diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf
index 30b4189b12..02150efdf8 100644
--- a/dist/saaws/default/analytic_stories.conf
+++ b/dist/saaws/default/analytic_stories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:41 UTC
+# On Date: 2021-07-29T20:53:37 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -50,7 +50,7 @@ id = 2f2f610a-d64d-48c2-b57c-96722b49ab5a
 version = 1
 reference = ["https://aws.amazon.com/security-hub/features/"]
 detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule"]
-mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]}
+mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
 support_searches = []
 data_models = []
@@ -191,8 +191,8 @@ modification_date = 2020-08-25
 id = 8168ca88-392e-42f4-85a2-767579c660ce
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
-detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"]
-mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
+detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
+mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"]
 data_models = ["Change"]
diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf
index 2e23fdb9e2..c941421ddb 100644
--- a/dist/saaws/default/analyticstories.conf
+++ b/dist/saaws/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:41 UTC
+# On Date: 2021-07-29T20:53:37 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -131,7 +131,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
 
@@ -553,10 +553,20 @@ asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 known_false_positives = None
 providing_technologies = []
 
+[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+providing_technologies = []
+
 [savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule]
 type = detection
 asset_type = Office 365
diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf
index 369032885d..aebee6a561 100644
--- a/dist/saaws/default/app.conf
+++ b/dist/saaws/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 34790
+build = 35236
 
 [triggers]
 reload.analytic_stories = simple
@@ -18,7 +18,7 @@ reload.content-version = simple
 
 [launcher]
 author = Splunk
-version = 3.25.2
+version = 3.26.0
 description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content
 
 [ui]
diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf
index 35e6437f0c..722a002171 100644
--- a/dist/saaws/default/collections.conf
+++ b/dist/saaws/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:41 UTC
+# On Date: 2021-07-29T20:53:37 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/saaws/default/content-version.conf b/dist/saaws/default/content-version.conf
index 0f980de608..41a20abb26 100644
--- a/dist/saaws/default/content-version.conf
+++ b/dist/saaws/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.25.2
+version = 3.26.0
diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf
index ec9a0f2606..2a68c27d93 100644
--- a/dist/saaws/default/macros.conf
+++ b/dist/saaws/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:41 UTC
+# On Date: 2021-07-29T20:53:37 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -143,7 +143,7 @@ definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
 [powershell]
-definition = sourcetype=wineventlog OR source=WinEventLog:Microsoft-Windows-PowerShell/Operational
+definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
 [previously_seen_cloud_api_calls_per_user_role_forget_window]
@@ -455,6 +455,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[detect_shared_ec2_snapshot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [o365_add_app_role_assignment_grant_user_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf
index d75afbde0b..20f19ea76f 100644
--- a/dist/saaws/default/savedsearches.conf
+++ b/dist/saaws/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:41 UTC
+# On Date: 2021-07-29T20:53:37 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -25,11 +25,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 49
 action.risk.param._risk_message = User $user$ created a policy version that allows them to access any resource in their account
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -67,11 +64,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 63
 action.risk.param._risk_message = User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63, "threat_object_field": "user_arn", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 63}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -109,11 +103,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 72
 action.risk.param._risk_message = User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$
-action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72, "threat_object_field": "user_arn", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 72}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -151,9 +142,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time.
 action.risk.param._risk = [{"threat_object_field": "requestingAccountId", "threat_object_type": "other"}, {"threat_object_field": "requestedAccountId", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
@@ -193,11 +181,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware Cloud"]
 action.risk = 1
-action.risk.param._risk_object = userIdentity.principalId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 25
 action.risk.param._risk_message = AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts.
-action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25, "threat_object_field": "userIdentity.principalId", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 25}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -235,11 +220,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Ransomware Cloud"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"threat_object_field": "dest_file", "threat_object_type": "file"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"threat_object_field": "dest_file", "threat_object_type": "file"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -277,11 +259,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50,  using the following commands $command$.
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -319,11 +298,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = userIdentity.arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
-action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10, "threat_object_field": "userIdentity.arn", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 10}, {"risk_object_field": "userIdentity.arn", "risk_object_type": "user", "risk_score": 10}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -361,11 +337,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 28
 action.risk.param._risk_message = User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name.
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 28}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 28}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -403,11 +376,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 10}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 10}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -445,11 +415,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = group_name
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = User $user_arn$ has had mulitple failures while attempting to delete groups from $src$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_name", "risk_object_type": "user", "risk_score": 5}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -487,11 +454,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = group_deleted
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}, {"risk_object_field": "group_deleted", "risk_object_type": "user", "risk_score": 5}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -529,11 +493,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
-action.risk.param._risk_object = requestParameters.cidrBlock
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "requestParameters.cidrBlock", "risk_object_type": "system", "risk_score": 48}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -571,11 +532,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 5
 action.risk.param._risk_message = User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 5}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 5}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -613,11 +571,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = sourceIPAddress
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$
-action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}]
+action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "recipientAccountId", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -655,11 +610,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = userIdentity.principalId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$
-action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "sourceIPAddress", "threat_object_type": "ip address"}, {"risk_object_field": "userIdentity.principalId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"risk_object_field": "sourceIPAddress", "risk_object_type": "system", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -697,11 +649,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -739,11 +688,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
-action.risk.param._risk_object = user_arn
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges
-action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -781,11 +727,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -823,9 +766,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 10
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -865,9 +805,6 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 40
 action.risk.param._risk_message = 
 action.risk.param._risk = []
 action.risk.param.verbose = 0
@@ -907,11 +844,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 15
 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -949,18 +883,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = false
@@ -991,11 +922,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1033,11 +961,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1075,11 +1000,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1117,18 +1039,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = false
@@ -1159,11 +1078,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1202,11 +1118,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1245,11 +1158,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = object
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1288,11 +1198,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = object_id
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object_id", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1331,11 +1238,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
-action.risk.param._risk_object = object
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1373,11 +1277,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 30
 action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1415,11 +1316,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1457,11 +1355,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1499,11 +1394,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 36
 action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1541,18 +1433,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
-action.risk.param._risk_object = userName
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
-action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
-action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
+action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
+action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = false
@@ -1563,7 +1452,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 
+search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 
 
 [ESCU - Detect New Open S3 buckets - Rule]
 action.escu = 0
@@ -1583,18 +1472,15 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
-action.risk.param._risk_object = userName
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
-action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$
-action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
+action.risk.param._risk_message = User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$
+action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect New Open S3 buckets - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = false
@@ -1605,13 +1491,13 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` 
+search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` 
 
 [ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
 action.escu = 0
 action.escu.enabled = 1
 description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
-action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 action.escu.data_models = []
 action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
@@ -1625,10 +1511,7 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["AWS Security Hub Alerts"]
 action.risk = 1
-action.risk.param._risk_object = 
-action.risk.param._risk_object_type = 
-action.risk.param._risk_score = 20
-action.risk.param._risk_message = 
+action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
 action.risk.param._risk = []
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -1636,7 +1519,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
-action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = false
@@ -1649,6 +1532,45 @@ realtime_schedule = 0
 is_visible = false
 search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
 
+[ESCU - Detect shared ec2 snapshot - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+action.escu.creation_date = 2021-07-20
+action.escu.modification_date = 2021-07-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect shared ec2 snapshot - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"]
+action.risk = 1
+action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$
+action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect shared ec2 snapshot - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Exfiltration"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = false
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` 
+
 [ESCU - O365 Add App Role Assignment Grant User - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1667,11 +1589,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = dest
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 18
 action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$
-action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1709,11 +1628,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = Target.ID
-action.risk.param._risk_object_type = system
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$
-action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Target.ID", "risk_object_type": "system", "risk_score": 42}]
+action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1751,11 +1667,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user_id
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 42
 action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA
-action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1793,11 +1706,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1835,11 +1745,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$.
-action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1877,11 +1784,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = UserId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$.
-action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1919,11 +1823,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
-action.risk.param._risk_object = UserId
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 64
 action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$
-action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}]
+action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -1961,11 +1862,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = Source
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$
-action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}, {"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2003,11 +1901,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2045,11 +1940,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
-action.risk.param._risk_object = user
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
@@ -2087,11 +1979,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise",
 action.escu.providing_technologies = []
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_object = ForwardingSmtpAddress
-action.risk.param._risk_object_type = user
-action.risk.param._risk_score = 48
 action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "ForwardingSmtpAddress", "risk_object_type": "user", "risk_score": 48}]
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf
index 18baa82dbb..86e558b025 100644
--- a/dist/saaws/default/transforms.conf
+++ b/dist/saaws/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:41 UTC
+# On Date: 2021-07-29T20:53:37 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf
index 2e23fdb9e2..c941421ddb 100644
--- a/dist/saaws/default/use_case_library.conf
+++ b/dist/saaws/default/use_case_library.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:41 UTC
+# On Date: 2021-07-29T20:53:37 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -131,7 +131,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
 
@@ -553,10 +553,20 @@ asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 known_false_positives = None
 providing_technologies = []
 
+[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+providing_technologies = []
+
 [savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule]
 type = detection
 asset_type = Office 365
diff --git a/docs/detections.md b/docs/detections.md
index 27e972612f..0dfe46634e 100644
--- a/docs/detections.md
+++ b/docs/detections.md
@@ -322,6 +322,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -473,6 +475,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [Detect shared ec2 snapshot](#detect-shared-ec2-snapshot)
+
+
+
 
 
 
@@ -682,6 +688,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
 
 
 
@@ -1082,6 +1092,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -1492,6 +1514,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [Detect Copy of ShadowCopy with Script Block Logging](#detect-copy-of-shadowcopy-with-script-block-logging)
+
+
+
 - [Detect Credential Dumping through LSASS access](#detect-credential-dumping-through-lsass-access)
 
 
@@ -1728,6 +1754,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 - [Detection of tools built by NirSoft](#detection-of-tools-built-by-nirsoft)
 
 
@@ -2068,6 +2096,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [Mshta spawning Rundll32 OR Regsvr32 Process](#mshta-spawning-rundll32-or-regsvr32-process)
+
+
+
 - [Msmpeng Application DLL Side Loading](#msmpeng-application-dll-side-loading)
 
 
@@ -2108,6 +2140,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [NET Profiler UAC bypass](#net-profiler-uac-bypass)
+
+
+
 - [NLTest Domain Trust Discovery](#nltest-domain-trust-discovery)
 
 
@@ -2162,6 +2198,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [Office Product Spawn CMD Process](#office-product-spawn-cmd-process)
+
+
+
 - [Office Product Spawning BITSAdmin](#office-product-spawning-bitsadmin)
 
 
@@ -2434,6 +2474,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [SAM Database File Access Attempt](#sam-database-file-access-attempt)
+
+
+
 - [SLUI RunAs Elevated](#slui-runas-elevated)
 
 
@@ -2484,6 +2528,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [Sdclt UAC Bypass](#sdclt-uac-bypass)
+
+
+
 - [SearchProtocolHost with no Command Line with Network](#searchprotocolhost-with-no-command-line-with-network)
 
 
@@ -2524,6 +2572,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [SilentCleanup UAC Bypass](#silentcleanup-uac-bypass)
+
+
+
 - [Single Letter Process On Endpoint](#single-letter-process-on-endpoint)
 
 
@@ -2688,6 +2740,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [UAC Bypass MMC Load Unsigned Dll](#uac-bypass-mmc-load-unsigned-dll)
+
+
+
 - [USN Journal Deletion](#usn-journal-deletion)
 
 
@@ -2742,6 +2798,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+- [WSReset UAC Bypass](#wsreset-uac-bypass)
+
+
+
 - [Wbemprox COM Object Execution](#wbemprox-com-object-execution)
 
 
@@ -3086,6 +3146,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -3296,6 +3358,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -3422,6 +3486,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -3504,6 +3570,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
 
 
 
@@ -3646,6 +3716,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -3774,6 +3846,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
 
 
 
@@ -3798,6 +3874,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 - [Unusually Long Content-Type Length](#unusually-long-content-type-length)
 
@@ -3859,6 +3937,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -4131,6 +4211,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -4285,6 +4367,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -4441,6 +4525,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 - [Multiple Okta Users With Invalid Credentials From The Same IP](#multiple-okta-users-with-invalid-credentials-from-the-same-ip)
 
@@ -4461,6 +4547,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 - [No Windows Updates in a time frame](#no-windows-updates-in-a-time-frame)
 
@@ -4505,6 +4593,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -4719,6 +4809,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
+
+
 
 
 
@@ -4815,6 +4911,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
 
 
 
@@ -5110,6 +5210,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -5426,6 +5528,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
 
 
 
@@ -5642,6 +5746,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
+
+
+
+
 
 
 
@@ -5706,6 +5818,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
 
 
 
@@ -5851,6 +5967,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
 
 
 
+
+
+
+
 
 
 
@@ -13534,7 +13654,7 @@ This search allows you to identify DNS requests and compute the standard deviati
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Network_Resolution
 - **ATT&CK**: [T1048.003](https://attack.mitre.org/techniques/T1048/003/)
-- **Last Updated**: 2021-01-18
+- **Last Updated**: 2021-07-21
 
 <details>
   <summary>details</summary>
@@ -13542,8 +13662,8 @@ This search allows you to identify DNS requests and compute the standard deviati
 #### Search
 ```
 
-| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query 
-|  `drop_dm_object_name("DNS")` 
+| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query 
+| `drop_dm_object_name("DNS")` 
 | eval query_length = len(query) 
 | table query query_length record_type count 
 | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50
@@ -14995,6 +15115,85 @@ None thus far found
 
 
 
+#### Test Dataset
+
+
+_version_: 1
+</details>
+
+---
+
+### Detect Copy of ShadowCopy with Script Block Logging
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: 
+- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003/002/)
+- **Last Updated**: 2021-07-21
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `detect_copy_of_shadowcopy_with_script_block_logging_filter`
+```
+#### Associated Analytic Story
+
+* Credential Dumping
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Required field
+
+* _time
+
+* Message
+
+* OpCode
+
+* ComputerName
+
+* User
+
+* EventCode
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1003.002 | Security Account Manager | Credential Access |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
+
+#### Reference
+
+
+* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+
+* https://github.com/GossiTheDog/HiveNightmare
+
+* https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+
+
+
 #### Test Dataset
 
 
@@ -16748,7 +16947,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 
 #### Search
 ```
-`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") 
+`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") 
 | rename requestParameters.bucketName AS bucketName 
 | fillnull 
 | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control 
@@ -16843,7 +17042,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") 
 | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") 
 | rename requestParameters.bucketName AS bucketName 
-| stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName 
+| stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName 
 | `security_content_ctime(firstTime)`
 | `security_content_ctime(lastTime)` 
 | `detect_new_open_s3_buckets_filter` 
@@ -16866,7 +17065,7 @@ You must install the AWS App for Splunk.
 
 * requestParameters.bucketName
 
-* userIdentity.userName
+* user_arn
 
 * userIdentity.principalId
 
@@ -18476,7 +18675,7 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
 
 #### Search
 ```
-`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) 
+`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe) 
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product 
 | rename Computer as dest 
 | `security_content_ctime(firstTime)` 
@@ -18654,7 +18853,7 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas
 
 #### Search
 ```
-`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe 
+`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe 
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product 
 | rename Computer as dest 
 | `security_content_ctime(firstTime)` 
@@ -20869,7 +21068,7 @@ This search looks for fast execution of processes used for system network config
 #### Search
 ```
 
-| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time 
+| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.user _time 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
 | `drop_dm_object_name(Processes)` 
@@ -20942,6 +21141,89 @@ It is uncommon for normal users to execute a series of commands used for network
 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log
 
 
+_version_: 2
+</details>
+
+---
+
+### Detect shared ec2 snapshot
+The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+
+- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: 
+- **ATT&CK**: [T1537](https://attack.mitre.org/techniques/T1537/)
+- **Last Updated**: 2021-07-20
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+`cloudtrail` eventName=ModifySnapshotAttribute 
+| rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id 
+| search requested_account_id != NULL 
+| eval match=if(requested_account_id==aws_account_id,"Match","No Match") 
+| table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent 
+| where match = "No Match" 
+| `detect_shared_ec2_snapshot_filter` 
+```
+#### Associated Analytic Story
+
+* Suspicious Cloud Instance Activities
+
+* Data Exfiltration
+
+
+#### How To Implement
+You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+
+#### Required field
+
+* _time
+
+* eventName
+
+* user_arn
+
+* src_ip
+
+* requestParameters.attributeType
+
+* aws_account_id
+
+* vendor_region
+
+* user_agent
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1537 | Transfer Data to Cloud Account | Exfiltration |
+
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+
+#### Known False Positives
+It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+
+#### Reference
+
+
+* https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
+
+
 _version_: 2
 </details>
 
@@ -28007,6 +28289,82 @@ _version_: 2
 
 ---
 
+### Mshta spawning Rundll32 OR Regsvr32 Process
+This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1218.005](https://attack.mitre.org/techniques/T1218/005/)
+- **Last Updated**: 2021-07-19
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "mshta.exe"  (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe) by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest 
+| `drop_dm_object_name("Processes")` 
+| `security_content_ctime(firstTime)` 
+|`security_content_ctime(lastTime)` 
+| `mshta_spawning_rundll32_or_regsvr32_process_filter`
+```
+#### Associated Analytic Story
+
+* Trickbot
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used.
+
+#### Required field
+
+* _time
+
+* parent_process
+
+* process_name
+
+* process
+
+* process_id
+
+* process_guid
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1218.005 | Mshta | Defense Evasion |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+limitted. this anomaly behavior is not commonly seen in clean host.
+
+#### Reference
+
+
+* https://twitter.com/cyb3rops/status/1416050325870587910?s=21
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+
+
+_version_: 1
+</details>
+
+---
+
 ### Msmpeng Application DLL Side Loading
 This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine
 
@@ -28919,6 +29277,80 @@ A host failing to authenticate with multiple valid users against a remote host i
 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
 
 
+_version_: 1
+</details>
+
+---
+
+### NET Profiler UAC bypass
+This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1548.002](https://attack.mitre.org/techniques/T1548/002/)
+- **Last Updated**: 2021-07-12
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `net_profiler_uac_bypass_filter`
+```
+#### Associated Analytic Story
+
+* Windows Defense Evasion Tactics
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Required field
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+limited false positive. It may trigger by some windows update that will modify this registry.
+
+#### Reference
+
+
+* https://offsec.almond.consulting/UAC-bypass-dotnet.html
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+
+
 _version_: 1
 </details>
 
@@ -30521,6 +30953,82 @@ _version_: 2
 
 ---
 
+### Office Product Spawn CMD Process
+this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1218.005](https://attack.mitre.org/techniques/T1218/005/)
+- **Last Updated**: 2021-07-19
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest 
+| `drop_dm_object_name("Processes")` 
+| `security_content_ctime(firstTime)` 
+|`security_content_ctime(lastTime)` 
+| `office_product_spawn_cmd_process_filter`
+```
+#### Associated Analytic Story
+
+* Trickbot
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Required field
+
+* _time
+
+* parent_process
+
+* process_name
+
+* process
+
+* process_id
+
+* process_guid
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1218.005 | Mshta | Defense Evasion |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+IT or network admin may create an document automation that will run shell script.
+
+#### Reference
+
+
+* https://twitter.com/cyb3rops/status/1416050325870587910?s=21
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+
+
+_version_: 1
+</details>
+
+---
+
 ### Office Product Spawning BITSAdmin
 The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity.
 
@@ -36175,6 +36683,85 @@ Limited to no known false positives.
 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log
 
 
+_version_: 1
+</details>
+
+---
+
+### SAM Database File Access Attempt
+The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003/002/)
+- **Last Updated**: 2021-07-23
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") 
+| stats values(Accesses) count by process_name Object_Name  dest user 
+| `sam_database_file_access_attempt_filter`
+```
+#### Associated Analytic Story
+
+* Credential Dumping
+
+
+#### How To Implement
+To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+
+#### Required field
+
+* _time
+
+* process_name
+
+* Object_Name
+
+* dest
+
+* user
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1003.002 | Security Account Manager | Credential Access |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+
+#### Reference
+
+
+* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
+
+* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+
+* https://github.com/GossiTheDog/HiveNightmare
+
+* https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+
+* https://en.wikipedia.org/wiki/Security_Account_Manager
+
+
+
+#### Test Dataset
+
+
 _version_: 1
 </details>
 
@@ -37279,6 +37866,84 @@ _version_: 4
 
 ---
 
+### Sdclt UAC Bypass
+This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1548.002](https://attack.mitre.org/techniques/T1548/002/)
+- **Last Updated**: 2021-07-01
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `sdclt_uac_bypass_filter`
+```
+#### Associated Analytic Story
+
+* Windows Defense Evasion Tactics
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+#### Required field
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+Limited to no false positives are expected.
+
+#### Reference
+
+
+* https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
+
+* https://github.com/hfiref0x/UACME
+
+* https://www.cyborgsecurity.com/cyborg_labs/threat-hunt-deep-dives-user-account-control-bypass-via-registry-modification/
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+
+
+_version_: 1
+</details>
+
+---
+
 ### SearchProtocolHost with no Command Line with Network
 The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 
@@ -38052,6 +38717,82 @@ _version_: 2
 
 ---
 
+### SilentCleanup UAC Bypass
+This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1548.002](https://attack.mitre.org/techniques/T1548/002/)
+- **Last Updated**: 2021-07-01
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_name = "*.exe*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `silentcleanup_uac_bypass_filter`
+```
+#### Associated Analytic Story
+
+* Windows Defense Evasion Tactics
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Required field
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+unknown
+
+#### Reference
+
+
+* https://github.com/hfiref0x/UACME
+
+* https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+
+
+_version_: 1
+</details>
+
+---
+
 ### Single Letter Process On Endpoint
 This search looks for process names that consist only of a single letter.
 
@@ -41578,6 +42319,87 @@ unknown
 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log
 
 
+_version_: 1
+</details>
+
+---
+
+### UAC Bypass MMC Load Unsigned Dll
+This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1548.002](https://attack.mitre.org/techniques/T1548/002/)
+- **Last Updated**: 2021-07-12
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+`sysmon` EventCode=7  ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName Computer EventCode Company 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `uac_bypass_mmc_load_unsigned_dll_filter`
+```
+#### Associated Analytic Story
+
+* Windows Defense Evasion Tactics
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Required field
+
+* _time
+
+* Image
+
+* ImageLoaded
+
+* Signed
+
+* ProcessId
+
+* OriginalFileName
+
+* Computer
+
+* EventCode
+
+* Company
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
+
+#### Reference
+
+
+* https://offsec.almond.consulting/UAC-bypass-dotnet.html
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+
+
 _version_: 1
 </details>
 
@@ -42648,6 +43470,82 @@ Some software may create WMI temporary event subscriptions for various purposes.
 #### Test Dataset
 
 
+_version_: 1
+</details>
+
+---
+
+### WSReset UAC Bypass
+This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1548.002](https://attack.mitre.org/techniques/T1548/002/)
+- **Last Updated**: 2021-07-01
+
+<details>
+  <summary>details</summary>
+
+#### Search
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `wsreset_uac_bypass_filter`
+```
+#### Associated Analytic Story
+
+* Windows Defense Evasion Tactics
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Required field
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion |
+
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Known False Positives
+unknown
+
+#### Reference
+
+
+* https://github.com/hfiref0x/UACME
+
+* https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
+
+
+
+#### Test Dataset
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+
+
 _version_: 1
 </details>
 
diff --git a/docs/detections.wiki b/docs/detections.wiki
index c11a11d127..efb1d4e9ef 100644
--- a/docs/detections.wiki
+++ b/docs/detections.wiki
@@ -4328,7 +4328,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 <div class="mw-collapsible-content">
 
 ====Search====
-<search>`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") 
+<search>`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") 
 | rename requestParameters.bucketName AS bucketName 
 | fillnull 
 | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control 
@@ -4428,7 +4428,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") 
 | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") 
 | rename requestParameters.bucketName AS bucketName 
-| stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName 
+| stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName 
 | `security_content_ctime(firstTime)`
 | `security_content_ctime(lastTime)` 
 | `detect_new_open_s3_buckets_filter` </search>
@@ -4451,7 +4451,7 @@ You must install the AWS App for Splunk.
 
 * requestParameters.bucketName
 
-* userIdentity.userName
+* user_arn
 
 * userIdentity.principalId
 
@@ -4870,6 +4870,94 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
 
 ----
 
+===Detect shared ec2 snapshot===
+The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+
+* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': 
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1537/ T1537]
+* '''Last Updated''': 2021-07-20
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>`cloudtrail` eventName=ModifySnapshotAttribute 
+| rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id 
+| search requested_account_id != NULL 
+| eval match=if(requested_account_id==aws_account_id,"Match","No Match") 
+| table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent 
+| where match = "No Match" 
+| `detect_shared_ec2_snapshot_filter` </search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Instance_Activities|Suspicious Cloud Instance Activities]]
+
+* [[Documentation:ESSOC:stories:UseCase#Data_Exfiltration|Data Exfiltration]]
+
+
+====How To Implement====
+You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+
+====Required field====
+
+* _time
+
+* eventName
+
+* user_arn
+
+* src_ip
+
+* requestParameters.attributeType
+
+* aws_account_id
+
+* vendor_region
+
+* user_agent
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1537
+| Transfer Data to Cloud Account
+| Exfiltration
+|}
+
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+
+====Known False Positives====
+It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+
+====Reference====
+
+
+* https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
+
+
+''version'': 2
+</div>
+</div>
+
+----
+
 ===Gcp detect gcploit framework===
 This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts.
 
@@ -12998,6 +13086,90 @@ None thus far found
 
 
 
+====Test Dataset====
+
+
+''version'': 1
+</div>
+</div>
+
+----
+
+===Detect copy of shadowcopy with script block logging===
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': 
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002]
+* '''Last Updated''': 2021-07-21
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `detect_copy_of_shadowcopy_with_script_block_logging_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]]
+
+
+====How To Implement====
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+====Required field====
+
+* _time
+
+* Message
+
+* OpCode
+
+* ComputerName
+
+* User
+
+* EventCode
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1003.002
+| Security Account Manager
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
+
+====Reference====
+
+
+* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+
+* https://github.com/GossiTheDog/HiveNightmare
+
+* https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+
+
+
 ====Test Dataset====
 
 
@@ -15815,7 +15987,7 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
 <div class="mw-collapsible-content">
 
 ====Search====
-<search>`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) 
+<search>`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe) 
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product 
 | rename Computer as dest 
 | `security_content_ctime(firstTime)` 
@@ -16003,7 +16175,7 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas
 <div class="mw-collapsible-content">
 
 ====Search====
-<search>`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe 
+<search>`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe 
 | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product 
 | rename Computer as dest 
 | `security_content_ctime(firstTime)` 
@@ -17146,7 +17318,7 @@ This search looks for fast execution of processes used for system network config
 
 ====Search====
 <search>
-| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time 
+| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.user _time 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
 | `drop_dm_object_name(Processes)` 
@@ -23893,6 +24065,87 @@ Some administrative tasks may involve multiple use of LOLBAS applications in a s
 
 ----
 
+===Mshta spawning rundll32 or regsvr32 process===
+This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005]
+* '''Last Updated''': 2021-07-19
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "mshta.exe"  (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe) by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest 
+| `drop_dm_object_name("Processes")` 
+| `security_content_ctime(firstTime)` 
+|`security_content_ctime(lastTime)` 
+| `mshta_spawning_rundll32_or_regsvr32_process_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used.
+
+====Required field====
+
+* _time
+
+* parent_process
+
+* process_name
+
+* process
+
+* process_id
+
+* process_guid
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1218.005
+| Mshta
+| Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+limitted. this anomaly behavior is not commonly seen in clean host.
+
+====Reference====
+
+
+* https://twitter.com/cyb3rops/status/1416050325870587910?s=21
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+
+
+''version'': 1
+</div>
+</div>
+
+----
+
 ===Msmpeng application dll side loading===
 This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine
 
@@ -24684,6 +24937,85 @@ A host failing to authenticate with multiple valid users against a remote host i
 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
 
 
+''version'': 1
+</div>
+</div>
+
+----
+
+===Net profiler uac bypass===
+This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002]
+* '''Last Updated''': 2021-07-12
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `net_profiler_uac_bypass_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+====Required field====
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1548.002
+| Bypass User Account Control
+| Privilege Escalation, Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+limited false positive. It may trigger by some windows update that will modify this registry.
+
+====Reference====
+
+
+* https://offsec.almond.consulting/UAC-bypass-dotnet.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+
+
 ''version'': 1
 </div>
 </div>
@@ -25328,6 +25660,87 @@ default browser not in the filter list
 
 ----
 
+===Office product spawn cmd process===
+this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005]
+* '''Last Updated''': 2021-07-19
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest 
+| `drop_dm_object_name("Processes")` 
+| `security_content_ctime(firstTime)` 
+|`security_content_ctime(lastTime)` 
+| `office_product_spawn_cmd_process_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+====Required field====
+
+* _time
+
+* parent_process
+
+* process_name
+
+* process
+
+* process_id
+
+* process_guid
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1218.005
+| Mshta
+| Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+IT or network admin may create an document automation that will run shell script.
+
+====Reference====
+
+
+* https://twitter.com/cyb3rops/status/1416050325870587910?s=21
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+
+
+''version'': 1
+</div>
+</div>
+
+----
+
 ===Office product spawning bitsadmin===
 The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity.
 
@@ -30728,6 +31141,90 @@ Limited to no known false positives.
 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log
 
 
+''version'': 1
+</div>
+</div>
+
+----
+
+===Sam database file access attempt===
+The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002]
+* '''Last Updated''': 2021-07-23
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") 
+| stats values(Accesses) count by process_name Object_Name  dest user 
+| `sam_database_file_access_attempt_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]]
+
+
+====How To Implement====
+To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+
+====Required field====
+
+* _time
+
+* process_name
+
+* Object_Name
+
+* dest
+
+* user
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1003.002
+| Security Account Manager
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+
+====Reference====
+
+
+* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
+
+* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+
+* https://github.com/GossiTheDog/HiveNightmare
+
+* https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+
+* https://en.wikipedia.org/wiki/Security_Account_Manager
+
+
+
+====Test Dataset====
+
+
 ''version'': 1
 </div>
 </div>
@@ -31657,6 +32154,89 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p
 
 ----
 
+===Sdclt uac bypass===
+This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002]
+* '''Last Updated''': 2021-07-01
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `sdclt_uac_bypass_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+====Required field====
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1548.002
+| Bypass User Account Control
+| Privilege Escalation, Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+Limited to no false positives are expected.
+
+====Reference====
+
+
+* https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
+
+* https://github.com/hfiref0x/UACME
+
+* https://www.cyborgsecurity.com/cyborg_labs/threat-hunt-deep-dives-user-account-control-bypass-via-registry-modification/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+
+
+''version'': 1
+</div>
+</div>
+
+----
+
 ===Searchprotocolhost with no command line with network===
 The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
 
@@ -32498,6 +33078,87 @@ It is possible that an administrator created and deleted an account in a short t
 
 ----
 
+===Silentcleanup uac bypass===
+This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002]
+* '''Last Updated''': 2021-07-01
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_name = "*.exe*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `silentcleanup_uac_bypass_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+====Required field====
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1548.002
+| Bypass User Account Control
+| Privilege Escalation, Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://github.com/hfiref0x/UACME
+
+* https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+
+
+''version'': 1
+</div>
+</div>
+
+----
+
 ===Single letter process on endpoint===
 This search looks for process names that consist only of a single letter.
 
@@ -35931,6 +36592,92 @@ unknown
 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log
 
 
+''version'': 1
+</div>
+</div>
+
+----
+
+===Uac bypass mmc load unsigned dll===
+This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002]
+* '''Last Updated''': 2021-07-12
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>`sysmon` EventCode=7  ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName Computer EventCode Company 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `uac_bypass_mmc_load_unsigned_dll_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+====Required field====
+
+* _time
+
+* Image
+
+* ImageLoaded
+
+* Signed
+
+* ProcessId
+
+* OriginalFileName
+
+* Computer
+
+* EventCode
+
+* Company
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1548.002
+| Bypass User Account Control
+| Privilege Escalation, Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
+
+====Reference====
+
+
+* https://offsec.almond.consulting/UAC-bypass-dotnet.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+
+
 ''version'': 1
 </div>
 </div>
@@ -36988,6 +37735,87 @@ Some software may create WMI temporary event subscriptions for various purposes.
 ====Test Dataset====
 
 
+''version'': 1
+</div>
+</div>
+
+----
+
+===Wsreset uac bypass===
+This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002]
+* '''Last Updated''': 2021-07-01
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Search====
+<search>
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `wsreset_uac_bypass_filter`</search>
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+====Required field====
+
+* _time
+
+* Registry.registry_path
+
+* Registry.registry_key_name
+
+* Registry.registry_value_name
+
+* Registry.dest
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1548.002
+| Bypass User Account Control
+| Privilege Escalation, Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://github.com/hfiref0x/UACME
+
+* https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+
+
 ''version'': 1
 </div>
 </div>
@@ -38659,15 +39487,15 @@ This search allows you to identify DNS requests and compute the standard deviati
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Network_Resolution
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003]
-* '''Last Updated''': 2021-01-18
+* '''Last Updated''': 2021-07-21
 
 <div class="toccolours mw-collapsible mw-collapsed">
 <div class="mw-collapsible-content">
 
 ====Search====
 <search>
-| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query 
-|  `drop_dm_object_name("DNS")` 
+| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query 
+| `drop_dm_object_name("DNS")` 
 | eval query_length = len(query) 
 | table query query_length record_type count 
 | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50
@@ -41460,7 +42288,7 @@ There might be false positives associted with this detection since items like ar
 <pre>
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-07-20 21:03:22.818639 UTC''
+# On Date: 2021-07-29 21:06:56.901053 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index dc5990997a..b199517dd8 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -43,8 +43,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -52,19 +52,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -97,11 +97,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -109,11 +114,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -266,8 +273,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -340,7 +347,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -467,12 +474,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -591,12 +598,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -941,7 +950,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -1143,8 +1152,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -1152,19 +1161,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -1197,11 +1206,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -1209,11 +1223,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -1366,8 +1382,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -1440,7 +1456,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -1567,12 +1583,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -1691,12 +1707,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -2041,7 +2059,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -2243,8 +2261,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -2252,19 +2270,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -2297,11 +2315,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -2309,11 +2332,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -2466,8 +2491,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -2540,7 +2565,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -2667,12 +2692,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -2791,12 +2816,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -3141,7 +3168,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -3343,8 +3370,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -3352,19 +3379,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -3397,11 +3424,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -3409,11 +3441,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -3566,8 +3600,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -3640,7 +3674,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -3767,12 +3801,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -3891,12 +3925,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -4241,7 +4277,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -4443,8 +4479,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -4452,19 +4488,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -4497,11 +4533,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -4509,11 +4550,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -4666,8 +4709,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -4740,7 +4783,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -4867,12 +4910,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -4991,12 +5034,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -5341,7 +5386,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -5543,8 +5588,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -5552,19 +5597,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -5597,11 +5642,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -5609,11 +5659,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -5766,8 +5818,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -5840,7 +5892,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -5967,12 +6019,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -6091,12 +6143,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -6441,7 +6495,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -6643,8 +6697,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -6652,19 +6706,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -6697,11 +6751,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -6709,11 +6768,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -6866,8 +6927,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -6940,7 +7001,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -7067,12 +7128,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -7191,12 +7252,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -7541,7 +7604,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -7743,8 +7806,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -7752,19 +7815,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -7797,11 +7860,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -7809,11 +7877,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -7966,8 +8036,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -8040,7 +8110,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -8167,12 +8237,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -8291,12 +8361,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -8641,7 +8713,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -8843,8 +8915,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -8852,19 +8924,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -8897,11 +8969,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -8909,11 +8986,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -9066,8 +9145,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -9140,7 +9219,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -9267,12 +9346,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -9391,12 +9470,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -9741,7 +9822,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -9943,8 +10024,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -9952,19 +10033,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -9997,11 +10078,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -10009,11 +10095,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -10166,8 +10254,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -10240,7 +10328,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -10367,12 +10455,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -10491,12 +10579,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -10841,7 +10931,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -11043,8 +11133,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -11052,19 +11142,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -11097,11 +11187,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -11109,11 +11204,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -11266,8 +11363,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -11340,7 +11437,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -11467,12 +11564,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -11591,12 +11688,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -11941,7 +12040,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -12143,8 +12242,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -12152,19 +12251,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -12197,11 +12296,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -12209,11 +12313,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -12366,8 +12472,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -12440,7 +12546,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -12567,12 +12673,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -12691,12 +12797,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -13041,7 +13149,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -13243,8 +13351,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -13252,19 +13360,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -13297,11 +13405,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -13309,11 +13422,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -13466,8 +13581,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -13540,7 +13655,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -13667,12 +13782,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -13791,12 +13906,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -14141,7 +14258,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -14343,8 +14460,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -14352,19 +14469,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -14397,11 +14514,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -14409,11 +14531,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -14566,8 +14690,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -14640,7 +14764,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -14767,12 +14891,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -14891,12 +15015,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -15241,7 +15367,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -15443,8 +15569,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -15452,19 +15578,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -15497,11 +15623,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -15509,11 +15640,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -15666,8 +15799,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -15740,7 +15873,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -15867,12 +16000,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -15991,12 +16124,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -16341,7 +16476,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -16543,8 +16678,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -16552,19 +16687,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -16597,11 +16732,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -16609,11 +16749,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -16766,8 +16908,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -16840,7 +16982,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -16967,12 +17109,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -17091,12 +17233,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -17441,7 +17585,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -17643,8 +17787,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -17652,19 +17796,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -17697,11 +17841,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -17709,11 +17858,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -17866,8 +18017,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -17940,7 +18091,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -18067,12 +18218,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -18191,12 +18342,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -18541,7 +18694,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -18743,8 +18896,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -18752,19 +18905,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -18797,11 +18950,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -18809,11 +18967,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -18966,8 +19126,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -19040,7 +19200,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -19167,12 +19327,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -19291,12 +19451,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -19641,7 +19803,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -19843,8 +20005,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -19852,19 +20014,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -19897,11 +20059,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -19909,11 +20076,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -20066,8 +20235,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -20140,7 +20309,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -20267,12 +20436,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -20391,12 +20560,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -20741,7 +20912,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -20943,8 +21114,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -20952,19 +21123,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -20997,11 +21168,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -21009,11 +21185,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -21166,8 +21344,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -21240,7 +21418,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -21367,12 +21545,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -21491,12 +21669,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -21841,7 +22021,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -22043,8 +22223,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -22052,19 +22232,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -22097,11 +22277,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -22109,11 +22294,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -22266,8 +22453,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -22340,7 +22527,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -22467,12 +22654,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -22591,12 +22778,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -22941,7 +23130,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -23143,8 +23332,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -23152,19 +23341,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -23197,11 +23386,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -23209,11 +23403,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -23366,8 +23562,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -23440,7 +23636,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -23567,12 +23763,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -23691,12 +23887,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -24041,7 +24239,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -24243,8 +24441,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -24252,19 +24450,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -24297,11 +24495,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -24309,11 +24512,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -24466,8 +24671,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -24540,7 +24745,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -24667,12 +24872,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -24791,12 +24996,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -25141,7 +25348,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -25343,8 +25550,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -25352,19 +25559,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -25397,11 +25604,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -25409,11 +25621,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -25566,8 +25780,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -25640,7 +25854,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -25767,12 +25981,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -25891,12 +26105,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -26241,7 +26457,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -26443,8 +26659,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -26452,19 +26668,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -26497,11 +26713,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -26509,11 +26730,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -26666,8 +26889,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -26740,7 +26963,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -26867,12 +27090,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -26991,12 +27214,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -27341,7 +27566,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -27543,8 +27768,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -27552,19 +27777,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -27597,11 +27822,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -27609,11 +27839,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -27766,8 +27998,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -27840,7 +28072,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -27967,12 +28199,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -28091,12 +28323,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -28441,7 +28675,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -28643,8 +28877,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -28652,19 +28886,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -28697,11 +28931,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -28709,11 +28948,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -28866,8 +29107,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -28940,7 +29181,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -29067,12 +29308,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -29191,12 +29432,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -29541,7 +29784,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -29743,8 +29986,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -29752,19 +29995,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -29797,11 +30040,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -29809,11 +30057,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -29966,8 +30216,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -30040,7 +30290,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -30167,12 +30417,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -30291,12 +30541,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -30641,7 +30893,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -30843,8 +31095,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -30852,19 +31104,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -30897,11 +31149,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -30909,11 +31166,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -31066,8 +31325,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -31140,7 +31399,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -31267,12 +31526,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -31391,12 +31650,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -31741,7 +32002,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -31943,8 +32204,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -31952,19 +32213,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -31997,11 +32258,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -32009,11 +32275,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -32166,8 +32434,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -32240,7 +32508,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -32367,12 +32635,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -32491,12 +32759,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -32841,7 +33111,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -33043,8 +33313,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -33052,19 +33322,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -33097,11 +33367,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -33109,11 +33384,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -33266,8 +33543,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -33340,7 +33617,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -33467,12 +33744,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -33591,12 +33868,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -33941,7 +34220,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -34143,8 +34422,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -34152,19 +34431,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -34197,11 +34476,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -34209,11 +34493,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -34366,8 +34652,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -34440,7 +34726,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -34567,12 +34853,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -34691,12 +34977,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -35041,7 +35329,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -35243,8 +35531,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -35252,19 +35540,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -35297,11 +35585,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -35309,11 +35602,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -35466,8 +35761,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -35540,7 +35835,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -35667,12 +35962,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -35791,12 +36086,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -36141,7 +36438,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -36343,8 +36640,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -36352,19 +36649,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -36397,11 +36694,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -36409,11 +36711,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -36566,8 +36870,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -36640,7 +36944,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -36767,12 +37071,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -36891,12 +37195,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -37241,7 +37547,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -37443,8 +37749,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -37452,19 +37758,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -37497,11 +37803,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -37509,11 +37820,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -37666,8 +37979,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -37740,7 +38053,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -37867,12 +38180,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -37991,12 +38304,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -38341,7 +38656,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -38543,8 +38858,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -38552,19 +38867,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -38597,11 +38912,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -38609,11 +38929,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -38766,8 +39088,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -38840,7 +39162,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -38967,12 +39289,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -39091,12 +39413,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -39441,7 +39765,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -39643,8 +39967,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -39652,19 +39976,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -39697,11 +40021,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -39709,11 +40038,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -39866,8 +40197,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -39940,7 +40271,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -40067,12 +40398,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -40191,12 +40522,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -40541,7 +40874,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -40743,8 +41076,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -40752,19 +41085,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -40797,11 +41130,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -40809,11 +41147,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -40966,8 +41306,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -41040,7 +41380,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -41167,12 +41507,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -41291,12 +41631,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -41641,7 +41983,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -41843,8 +42185,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -41852,19 +42194,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -41897,11 +42239,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -41909,11 +42256,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -42066,8 +42415,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -42140,7 +42489,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -42267,12 +42616,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -42391,12 +42740,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -42741,7 +43092,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -42943,8 +43294,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -42952,19 +43303,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -42997,11 +43348,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -43009,11 +43365,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -43166,8 +43524,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -43240,7 +43598,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -43367,12 +43725,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -43491,12 +43849,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -43841,7 +44201,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -44043,8 +44403,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -44052,19 +44412,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -44097,11 +44457,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -44109,11 +44474,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -44266,8 +44633,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -44340,7 +44707,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -44467,12 +44834,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -44591,12 +44958,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -44941,7 +45310,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -45143,8 +45512,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -45152,19 +45521,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -45197,11 +45566,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -45209,11 +45583,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -45366,8 +45742,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -45440,7 +45816,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -45567,12 +45943,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -45691,12 +46067,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -46041,7 +46419,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -46243,8 +46621,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -46252,19 +46630,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -46297,11 +46675,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -46309,11 +46692,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -46466,8 +46851,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -46540,7 +46925,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -46667,12 +47052,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -46791,12 +47176,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -47141,7 +47528,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -47343,8 +47730,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -47352,19 +47739,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -47397,11 +47784,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -47409,11 +47801,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -47566,8 +47960,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -47640,7 +48034,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -47767,12 +48161,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -47891,12 +48285,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -48241,7 +48637,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -48443,8 +48839,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -48452,19 +48848,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -48497,11 +48893,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -48509,11 +48910,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -48666,8 +49069,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -48740,7 +49143,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -48867,12 +49270,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -48991,12 +49394,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -49341,7 +49746,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -49543,8 +49948,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -49552,19 +49957,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -49597,11 +50002,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -49609,11 +50019,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -49766,8 +50178,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -49840,7 +50252,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -49967,12 +50379,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -50091,12 +50503,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -50441,7 +50855,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -50643,8 +51057,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -50652,19 +51066,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -50697,11 +51111,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -50709,11 +51128,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -50866,8 +51287,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -50940,7 +51361,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -51067,12 +51488,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -51191,12 +51612,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -51541,7 +51964,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -51743,8 +52166,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -51752,19 +52175,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -51797,11 +52220,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -51809,11 +52237,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -51966,8 +52396,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -52040,7 +52470,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -52167,12 +52597,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -52291,12 +52721,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -52641,7 +53073,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -52843,8 +53275,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -52852,19 +53284,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -52897,11 +53329,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -52909,11 +53346,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -53066,8 +53505,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -53140,7 +53579,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -53267,12 +53706,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -53391,12 +53830,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -53741,7 +54182,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -53943,8 +54384,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -53952,19 +54393,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -53997,11 +54438,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -54009,11 +54455,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -54166,8 +54614,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -54240,7 +54688,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -54367,12 +54815,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -54491,12 +54939,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -54841,7 +55291,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -55043,8 +55493,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -55052,19 +55502,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -55097,11 +55547,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -55109,11 +55564,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -55266,8 +55723,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -55340,7 +55797,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -55467,12 +55924,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -55591,12 +56048,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -55941,7 +56400,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -56143,8 +56602,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -56152,19 +56611,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -56197,11 +56656,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -56209,11 +56673,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -56366,8 +56832,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -56440,7 +56906,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -56567,12 +57033,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -56691,12 +57157,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -57041,7 +57509,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -57243,8 +57711,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -57252,19 +57720,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -57297,11 +57765,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -57309,11 +57782,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -57466,8 +57941,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -57540,7 +58015,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -57667,12 +58142,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -57791,12 +58266,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -58141,7 +58618,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -58343,8 +58820,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -58352,19 +58829,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -58397,11 +58874,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -58409,11 +58891,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -58566,8 +59050,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -58640,7 +59124,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -58767,12 +59251,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -58891,12 +59375,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -59241,7 +59727,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -59443,8 +59929,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -59452,19 +59938,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -59497,11 +59983,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -59509,11 +60000,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -59666,8 +60159,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -59740,7 +60233,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -59867,12 +60360,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -59991,12 +60484,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -60341,7 +60836,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -60543,8 +61038,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -60552,19 +61047,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -60597,11 +61092,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -60609,11 +61109,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -60766,8 +61268,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -60840,7 +61342,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -60967,12 +61469,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -61091,12 +61593,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -61441,7 +61945,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -61643,8 +62147,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -61652,19 +62156,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -61697,11 +62201,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -61709,11 +62218,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -61866,8 +62377,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -61940,7 +62451,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -62067,12 +62578,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -62191,12 +62702,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -62541,7 +63054,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -62743,8 +63256,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -62752,19 +63265,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -62797,11 +63310,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -62809,11 +63327,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -62966,8 +63486,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -63040,7 +63560,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -63167,12 +63687,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -63291,12 +63811,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -63641,7 +64163,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -63843,8 +64365,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -63852,19 +64374,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -63897,11 +64419,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -63909,11 +64436,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -64066,8 +64595,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -64140,7 +64669,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -64267,12 +64796,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -64391,12 +64920,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -64741,7 +65272,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -64943,8 +65474,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -64952,19 +65483,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -64997,11 +65528,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -65009,11 +65545,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -65166,8 +65704,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -65240,7 +65778,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -65367,12 +65905,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -65491,12 +66029,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -65841,7 +66381,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -66043,8 +66583,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -66052,19 +66592,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -66097,11 +66637,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -66109,11 +66654,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -66266,8 +66813,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -66340,7 +66887,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -66467,12 +67014,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -66591,12 +67138,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -66941,7 +67490,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -67143,8 +67692,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -67152,19 +67701,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -67197,11 +67746,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -67209,11 +67763,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -67366,8 +67922,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -67440,7 +67996,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -67567,12 +68123,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -67691,12 +68247,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -68041,7 +68599,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -68243,8 +68801,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -68252,19 +68810,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -68297,11 +68855,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -68309,11 +68872,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -68466,8 +69031,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -68540,7 +69105,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -68667,12 +69232,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -68791,12 +69356,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -69141,7 +69708,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -69343,8 +69910,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -69352,19 +69919,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -69397,11 +69964,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -69409,11 +69981,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -69566,8 +70140,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -69640,7 +70214,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -69767,12 +70341,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -69891,12 +70465,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -70241,7 +70817,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -70443,8 +71019,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -70452,19 +71028,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -70497,11 +71073,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -70509,11 +71090,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -70666,8 +71249,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -70740,7 +71323,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -70867,12 +71450,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -70991,12 +71574,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -71341,7 +71926,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -71543,8 +72128,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -71552,19 +72137,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -71597,11 +72182,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -71609,11 +72199,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -71766,8 +72358,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -71840,7 +72432,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -71967,12 +72559,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -72091,12 +72683,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -72441,7 +73035,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -72643,8 +73237,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -72652,19 +73246,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -72697,11 +73291,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -72709,11 +73308,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -72866,8 +73467,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -72940,7 +73541,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -73067,12 +73668,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -73191,12 +73792,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -73541,7 +74144,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -73743,8 +74346,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -73752,19 +74355,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -73797,11 +74400,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -73809,11 +74417,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -73966,8 +74576,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -74040,7 +74650,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -74167,12 +74777,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -74291,12 +74901,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -74641,7 +75253,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -74843,8 +75455,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -74852,19 +75464,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -74897,11 +75509,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -74909,11 +75526,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -75066,8 +75685,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -75140,7 +75759,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -75267,12 +75886,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -75391,12 +76010,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -75741,7 +76362,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -75943,8 +76564,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -75952,19 +76573,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -75997,11 +76618,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -76009,11 +76635,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -76166,8 +76794,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -76240,7 +76868,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -76367,12 +76995,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -76491,12 +77119,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -76841,7 +77471,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -77043,8 +77673,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -77052,19 +77682,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -77097,11 +77727,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -77109,11 +77744,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -77266,8 +77903,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -77340,7 +77977,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -77467,12 +78104,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -77591,12 +78228,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -77941,7 +78580,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -78143,8 +78782,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -78152,19 +78791,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -78197,11 +78836,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -78209,11 +78853,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -78366,8 +79012,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -78440,7 +79086,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -78567,12 +79213,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -78691,12 +79337,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -79041,7 +79689,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -79243,8 +79891,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -79252,19 +79900,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -79297,11 +79945,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -79309,11 +79962,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -79466,8 +80121,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -79540,7 +80195,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -79667,12 +80322,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -79791,12 +80446,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -80141,7 +80798,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -80343,8 +81000,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -80352,19 +81009,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -80397,11 +81054,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -80409,11 +81071,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -80566,8 +81230,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -80640,7 +81304,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -80767,12 +81431,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -80891,12 +81555,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -81241,7 +81907,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -81443,8 +82109,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -81452,19 +82118,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -81497,11 +82163,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -81509,11 +82180,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -81666,8 +82339,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -81740,7 +82413,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -81867,12 +82540,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -81991,12 +82664,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -82341,7 +83016,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -82543,8 +83218,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -82552,19 +83227,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -82597,11 +83272,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -82609,11 +83289,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -82766,8 +83448,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -82840,7 +83522,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -82967,12 +83649,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -83091,12 +83773,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -83441,7 +84125,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -83643,8 +84327,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -83652,19 +84336,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -83697,11 +84381,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -83709,11 +84398,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -83866,8 +84557,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -83940,7 +84631,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -84067,12 +84758,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -84191,12 +84882,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -84541,7 +85234,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -84743,8 +85436,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -84752,19 +85445,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -84797,11 +85490,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -84809,11 +85507,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -84966,8 +85666,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -85040,7 +85740,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -85167,12 +85867,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -85291,12 +85991,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -85641,7 +86343,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -85843,8 +86545,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -85852,19 +86554,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -85897,11 +86599,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -85909,11 +86616,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -86066,8 +86775,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -86140,7 +86849,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -86267,12 +86976,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -86391,12 +87100,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -86741,7 +87452,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -86943,8 +87654,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -86952,19 +87663,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -86997,11 +87708,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -87009,11 +87725,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -87166,8 +87884,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -87240,7 +87958,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -87367,12 +88085,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -87491,12 +88209,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -87841,7 +88561,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -88043,8 +88763,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -88052,19 +88772,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -88097,11 +88817,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -88109,11 +88834,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -88266,8 +88993,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -88340,7 +89067,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -88467,12 +89194,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -88591,12 +89318,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -88941,7 +89670,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -89143,8 +89872,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -89152,19 +89881,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -89197,11 +89926,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -89209,11 +89943,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -89366,8 +90102,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -89440,7 +90176,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -89567,12 +90303,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -89691,12 +90427,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -90041,7 +90779,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -90243,8 +90981,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -90252,19 +90990,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -90297,11 +91035,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -90309,11 +91052,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -90466,8 +91211,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -90540,7 +91285,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -90667,12 +91412,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -90791,12 +91536,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -91141,7 +91888,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -91343,8 +92090,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -91352,19 +92099,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -91397,11 +92144,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -91409,11 +92161,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -91566,8 +92320,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -91640,7 +92394,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -91767,12 +92521,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -91891,12 +92645,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -92241,7 +92997,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -92443,8 +93199,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -92452,19 +93208,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -92497,11 +93253,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -92509,11 +93270,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -92666,8 +93429,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -92740,7 +93503,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -92867,12 +93630,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -92991,12 +93754,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -93341,7 +94106,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -93543,8 +94308,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -93552,19 +94317,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -93597,11 +94362,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -93609,11 +94379,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -93766,8 +94538,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -93840,7 +94612,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -93967,12 +94739,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -94091,12 +94863,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -94441,7 +95215,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -94643,8 +95417,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -94652,19 +95426,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -94697,11 +95471,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -94709,11 +95488,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -94866,8 +95647,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -94940,7 +95721,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -95067,12 +95848,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -95191,12 +95972,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -95541,7 +96324,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -95743,8 +96526,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -95752,19 +96535,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -95797,11 +96580,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -95809,11 +96597,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -95966,8 +96756,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -96040,7 +96830,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -96167,12 +96957,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -96291,12 +97081,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -96641,7 +97433,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -96843,8 +97635,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -96852,19 +97644,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -96897,11 +97689,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -96909,11 +97706,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -97066,8 +97865,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -97140,7 +97939,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -97267,12 +98066,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -97391,12 +98190,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -97741,7 +98542,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -97943,8 +98744,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -97952,19 +98753,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -97997,11 +98798,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -98009,11 +98815,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -98166,8 +98974,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -98240,7 +99048,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -98367,12 +99175,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -98491,12 +99299,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -98841,7 +99651,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -99043,8 +99853,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -99052,19 +99862,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -99097,11 +99907,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -99109,11 +99924,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -99266,8 +100083,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -99340,7 +100157,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -99467,12 +100284,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -99591,12 +100408,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -99941,7 +100760,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -100143,8 +100962,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -100152,19 +100971,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -100197,11 +101016,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -100209,11 +101033,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -100366,8 +101192,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -100440,7 +101266,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -100567,12 +101393,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -100691,12 +101517,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -101041,7 +101869,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -101243,8 +102071,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -101252,19 +102080,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -101297,11 +102125,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -101309,11 +102142,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -101466,8 +102301,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -101540,7 +102375,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -101667,12 +102502,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -101791,12 +102626,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -102141,7 +102978,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -102343,8 +103180,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -102352,19 +103189,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -102397,11 +103234,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -102409,11 +103251,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -102566,8 +103410,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -102640,7 +103484,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -102767,12 +103611,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -102891,12 +103735,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -103241,7 +104087,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -103443,8 +104289,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -103452,19 +104298,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -103497,11 +104343,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -103509,11 +104360,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -103666,8 +104519,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -103740,7 +104593,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -103867,12 +104720,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -103991,12 +104844,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -104341,7 +105196,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -104543,8 +105398,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -104552,19 +105407,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -104597,11 +105452,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -104609,11 +105469,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -104766,8 +105628,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -104840,7 +105702,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -104967,12 +105829,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -105091,12 +105953,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -105441,7 +106305,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -105643,8 +106507,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -105652,19 +106516,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -105697,11 +106561,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -105709,11 +106578,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -105866,8 +106737,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -105940,7 +106811,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -106067,12 +106938,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -106191,12 +107062,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -106541,7 +107414,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -106743,8 +107616,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -106752,19 +107625,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -106797,11 +107670,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -106809,11 +107687,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -106966,8 +107846,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -107040,7 +107920,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -107167,12 +108047,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -107291,12 +108171,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -107641,7 +108523,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -107843,8 +108725,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -107852,19 +108734,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -107897,11 +108779,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -107909,11 +108796,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -108066,8 +108955,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -108140,7 +109029,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -108267,12 +109156,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -108391,12 +109280,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -108741,7 +109632,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -108943,8 +109834,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -108952,19 +109843,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -108997,11 +109888,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -109009,11 +109905,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -109166,8 +110064,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -109240,7 +110138,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -109367,12 +110265,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -109491,12 +110389,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -109841,7 +110741,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -110043,8 +110943,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -110052,19 +110952,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -110097,11 +110997,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -110109,11 +111014,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -110266,8 +111173,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -110340,7 +111247,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -110467,12 +111374,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -110591,12 +111498,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -110941,7 +111850,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -111143,8 +112052,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -111152,19 +112061,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -111197,11 +112106,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -111209,11 +112123,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -111366,8 +112282,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -111440,7 +112356,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -111567,12 +112483,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -111691,12 +112607,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -112041,7 +112959,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -112243,8 +113161,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -112252,19 +113170,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -112297,11 +113215,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -112309,11 +113232,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -112466,8 +113391,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -112540,7 +113465,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -112667,12 +113592,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -112791,12 +113716,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -113141,7 +114068,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -113343,8 +114270,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -113352,19 +114279,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -113397,11 +114324,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -113409,11 +114341,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -113566,8 +114500,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -113640,7 +114574,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -113767,12 +114701,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -113891,12 +114825,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -114241,7 +115177,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -114443,8 +115379,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -114452,19 +115388,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -114497,11 +115433,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -114509,11 +115450,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -114666,8 +115609,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -114740,7 +115683,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -114867,12 +115810,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -114991,12 +115934,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -115341,7 +116286,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -115543,8 +116488,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -115552,19 +116497,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -115597,11 +116542,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -115609,11 +116559,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -115766,8 +116718,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -115840,7 +116792,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -115967,12 +116919,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -116091,12 +117043,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -116441,7 +117395,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -116643,8 +117597,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -116652,19 +117606,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -116697,11 +117651,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -116709,11 +117668,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -116866,8 +117827,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -116940,7 +117901,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -117067,12 +118028,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -117191,12 +118152,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -117541,7 +118504,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -117743,8 +118706,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -117752,19 +118715,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -117797,11 +118760,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -117809,11 +118777,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -117966,8 +118936,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -118040,7 +119010,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -118167,12 +119137,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -118291,12 +119261,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -118641,7 +119613,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -118843,8 +119815,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -118852,19 +119824,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -118897,11 +119869,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -118909,11 +119886,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -119066,8 +120045,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -119140,7 +120119,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -119267,12 +120246,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -119391,12 +120370,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -119741,7 +120722,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -119943,8 +120924,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -119952,19 +120933,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -119997,11 +120978,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -120009,11 +120995,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -120166,8 +121154,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -120240,7 +121228,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -120367,12 +121355,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -120491,12 +121479,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -120841,7 +121831,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -121043,8 +122033,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -121052,19 +122042,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -121097,11 +122087,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -121109,11 +122104,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -121266,8 +122263,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -121340,7 +122337,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -121467,12 +122464,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -121591,12 +122588,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -121941,7 +122940,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -122143,8 +123142,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -122152,19 +123151,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -122197,11 +123196,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -122209,11 +123213,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -122366,8 +123372,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -122440,7 +123446,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -122567,12 +123573,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -122691,12 +123697,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -123041,7 +124049,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -123243,8 +124251,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -123252,19 +124260,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -123297,11 +124305,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -123309,11 +124322,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -123466,8 +124481,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -123540,7 +124555,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -123667,12 +124682,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -123791,12 +124806,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -124141,7 +125158,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -124343,8 +125360,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -124352,19 +125369,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -124397,11 +125414,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -124409,11 +125431,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -124566,8 +125590,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -124640,7 +125664,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -124767,12 +125791,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -124891,12 +125915,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -125241,7 +126267,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -125443,8 +126469,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -125452,19 +126478,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -125497,11 +126523,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -125509,11 +126540,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -125666,8 +126699,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -125740,7 +126773,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -125867,12 +126900,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -125991,12 +127024,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -126341,7 +127376,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -126543,8 +127578,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -126552,19 +127587,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -126597,11 +127632,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -126609,11 +127649,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -126766,8 +127808,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -126840,7 +127882,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -126967,12 +128009,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -127091,12 +128133,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -127441,7 +128485,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -127643,8 +128687,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -127652,19 +128696,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -127697,11 +128741,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -127709,11 +128758,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -127866,8 +128917,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -127940,7 +128991,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -128067,12 +129118,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -128191,12 +129242,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -128541,7 +129594,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -128743,8 +129796,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -128752,19 +129805,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -128797,11 +129850,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -128809,11 +129867,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -128966,8 +130026,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -129040,7 +130100,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -129167,12 +130227,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -129291,12 +130351,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -129641,7 +130703,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -129843,8 +130905,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -129852,19 +130914,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -129897,11 +130959,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -129909,11 +130976,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -130066,8 +131135,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -130140,7 +131209,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -130267,12 +131336,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -130391,12 +131460,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -130741,7 +131812,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -130943,8 +132014,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -130952,19 +132023,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -130997,11 +132068,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -131009,11 +132085,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -131166,8 +132244,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -131240,7 +132318,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -131367,12 +132445,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -131491,12 +132569,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -131841,7 +132921,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -132043,8 +133123,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -132052,19 +133132,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -132097,11 +133177,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -132109,11 +133194,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -132266,8 +133353,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -132340,7 +133427,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -132467,12 +133554,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -132591,12 +133678,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -132941,7 +134030,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -133143,8 +134232,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -133152,19 +134241,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -133197,11 +134286,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -133209,11 +134303,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -133366,8 +134462,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -133440,7 +134536,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -133567,12 +134663,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -133691,12 +134787,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -134041,7 +135139,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -134243,8 +135341,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -134252,19 +135350,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -134297,11 +135395,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -134309,11 +135412,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -134466,8 +135571,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -134540,7 +135645,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -134667,12 +135772,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -134791,12 +135896,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -135141,7 +136248,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -135343,8 +136450,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -135352,19 +136459,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -135397,11 +136504,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -135409,11 +136521,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -135566,8 +136680,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -135640,7 +136754,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -135767,12 +136881,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -135891,12 +137005,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -136241,7 +137357,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -136443,8 +137559,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -136452,19 +137568,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -136497,11 +137613,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -136509,11 +137630,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -136666,8 +137789,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -136740,7 +137863,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -136867,12 +137990,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -136991,12 +138114,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -137341,7 +138466,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -137543,8 +138668,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -137552,19 +138677,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -137597,11 +138722,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -137609,11 +138739,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -137766,8 +138898,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -137840,7 +138972,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -137967,12 +139099,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -138091,12 +139223,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -138441,7 +139575,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -138643,8 +139777,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -138652,19 +139786,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -138697,11 +139831,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -138709,11 +139848,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -138866,8 +140007,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -138940,7 +140081,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -139067,12 +140208,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -139191,12 +140332,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -139541,7 +140684,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -139743,8 +140886,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -139752,19 +140895,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -139797,11 +140940,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -139809,11 +140957,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -139966,8 +141116,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -140040,7 +141190,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -140167,12 +141317,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -140291,12 +141441,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -140641,7 +141793,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -140843,8 +141995,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -140852,19 +142004,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -140897,11 +142049,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -140909,11 +142066,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -141066,8 +142225,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -141140,7 +142299,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -141267,12 +142426,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -141391,12 +142550,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -141741,7 +142902,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -141943,8 +143104,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -141952,19 +143113,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -141997,11 +143158,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -142009,11 +143175,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -142166,8 +143334,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -142240,7 +143408,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -142367,12 +143535,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -142491,12 +143659,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -142841,7 +144011,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -143043,8 +144213,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -143052,19 +144222,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -143097,11 +144267,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -143109,11 +144284,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -143266,8 +144443,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -143340,7 +144517,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -143467,12 +144644,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -143591,12 +144768,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -143941,7 +145120,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -144143,8 +145322,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -144152,19 +145331,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -144197,11 +145376,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -144209,11 +145393,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -144366,8 +145552,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -144440,7 +145626,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -144567,12 +145753,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -144691,12 +145877,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -145041,7 +146229,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -145243,8 +146431,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -145252,19 +146440,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -145297,11 +146485,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -145309,11 +146502,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -145466,8 +146661,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -145540,7 +146735,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -145667,12 +146862,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -145791,12 +146986,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -146141,7 +147338,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -146343,8 +147540,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -146352,19 +147549,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -146397,11 +147594,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -146409,11 +147611,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -146566,8 +147770,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -146640,7 +147844,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -146767,12 +147971,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -146891,12 +148095,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -147241,7 +148447,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -147443,8 +148649,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -147452,19 +148658,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -147497,11 +148703,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -147509,11 +148720,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -147666,8 +148879,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -147740,7 +148953,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -147867,12 +149080,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -147991,12 +149204,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -148341,7 +149556,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -148543,8 +149758,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -148552,19 +149767,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -148597,11 +149812,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -148609,11 +149829,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -148766,8 +149988,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -148840,7 +150062,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -148967,12 +150189,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -149091,12 +150313,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -149441,7 +150665,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -149643,8 +150867,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -149652,19 +150876,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -149697,11 +150921,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -149709,11 +150938,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -149866,8 +151097,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -149940,7 +151171,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -150067,12 +151298,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -150191,12 +151422,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -150541,7 +151774,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -150743,8 +151976,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -150752,19 +151985,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -150797,11 +152030,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -150809,11 +152047,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -150966,8 +152206,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -151040,7 +152280,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -151167,12 +152407,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -151291,12 +152531,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -151641,7 +152883,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -151843,8 +153085,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -151852,19 +153094,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -151897,11 +153139,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -151909,11 +153156,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -152066,8 +153315,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -152140,7 +153389,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -152267,12 +153516,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -152391,12 +153640,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -152741,7 +153992,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -152943,8 +154194,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -152952,19 +154203,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -152997,11 +154248,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -153009,11 +154265,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -153166,8 +154424,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -153240,7 +154498,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -153367,12 +154625,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -153491,12 +154749,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -153841,7 +155101,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -154043,8 +155303,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -154052,19 +155312,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -154097,11 +155357,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -154109,11 +155374,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -154266,8 +155533,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -154340,7 +155607,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -154467,12 +155734,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -154591,12 +155858,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -154941,7 +156210,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -155143,8 +156412,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -155152,19 +156421,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -155197,11 +156466,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -155209,11 +156483,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -155366,8 +156642,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -155440,7 +156716,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -155567,12 +156843,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -155691,12 +156967,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -156041,7 +157319,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -156243,8 +157521,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -156252,19 +157530,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -156297,11 +157575,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -156309,11 +157592,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -156466,8 +157751,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -156540,7 +157825,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -156667,12 +157952,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -156791,12 +158076,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -157141,7 +158428,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -157343,8 +158630,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -157352,19 +158639,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -157397,11 +158684,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -157409,11 +158701,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -157566,8 +158860,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -157640,7 +158934,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -157767,12 +159061,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -157891,12 +159185,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -158241,7 +159537,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -158443,8 +159739,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -158452,19 +159748,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -158497,11 +159793,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -158509,11 +159810,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -158666,8 +159969,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -158740,7 +160043,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -158867,12 +160170,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -158991,12 +160294,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -159341,7 +160646,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -159543,8 +160848,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -159552,19 +160857,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -159597,11 +160902,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -159609,11 +160919,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -159766,8 +161078,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -159840,7 +161152,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -159967,12 +161279,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -160091,12 +161403,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -160441,7 +161755,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -160643,8 +161957,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -160652,19 +161966,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -160697,11 +162011,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -160709,11 +162028,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -160866,8 +162187,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -160940,7 +162261,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -161067,12 +162388,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -161191,12 +162512,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -161541,7 +162864,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -161743,8 +163066,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -161752,19 +163075,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -161797,11 +163120,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -161809,11 +163137,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -161966,8 +163296,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -162040,7 +163370,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -162167,12 +163497,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -162291,12 +163621,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -162641,7 +163973,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -162843,8 +164175,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -162852,19 +164184,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -162897,11 +164229,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -162909,11 +164246,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -163066,8 +164405,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -163140,7 +164479,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -163267,12 +164606,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -163391,12 +164730,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -163741,7 +165082,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -163943,8 +165284,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -163952,19 +165293,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -163997,11 +165338,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -164009,11 +165355,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -164166,8 +165514,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -164240,7 +165588,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -164367,12 +165715,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -164491,12 +165839,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -164841,7 +166191,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -165043,8 +166393,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -165052,19 +166402,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -165097,11 +166447,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -165109,11 +166464,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -165266,8 +166623,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -165340,7 +166697,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -165467,12 +166824,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -165591,12 +166948,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -165941,7 +167300,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -166143,8 +167502,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -166152,19 +167511,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -166197,11 +167556,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -166209,11 +167573,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -166366,8 +167732,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -166440,7 +167806,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -166567,12 +167933,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -166691,12 +168057,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -167041,7 +168409,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -167243,8 +168611,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -167252,19 +168620,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -167297,11 +168665,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -167309,11 +168682,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -167466,8 +168841,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -167540,7 +168915,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -167667,12 +169042,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -167791,12 +169166,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -168141,7 +169518,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -168343,8 +169720,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -168352,19 +169729,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -168397,11 +169774,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -168409,11 +169791,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -168566,8 +169950,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -168640,7 +170024,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -168767,12 +170151,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -168891,12 +170275,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -169241,7 +170627,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -169443,8 +170829,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -169452,19 +170838,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -169497,11 +170883,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -169509,11 +170900,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -169666,8 +171059,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -169740,7 +171133,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -169867,12 +171260,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -169991,12 +171384,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -170341,7 +171736,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -170543,8 +171938,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -170552,19 +171947,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -170597,11 +171992,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -170609,11 +172009,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -170766,8 +172168,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -170840,7 +172242,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -170967,12 +172369,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -171091,12 +172493,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -171441,7 +172845,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -171643,8 +173047,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -171652,19 +173056,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -171697,11 +173101,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -171709,11 +173118,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -171866,8 +173277,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -171940,7 +173351,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -172067,12 +173478,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -172191,12 +173602,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -172541,7 +173954,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -172743,8 +174156,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -172752,19 +174165,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -172797,11 +174210,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -172809,11 +174227,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -172966,8 +174386,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -173040,7 +174460,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -173167,12 +174587,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -173291,12 +174711,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -173641,7 +175063,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -173843,8 +175265,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -173852,19 +175274,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -173897,11 +175319,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -173909,11 +175336,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -174066,8 +175495,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -174140,7 +175569,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -174267,12 +175696,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -174391,12 +175820,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -174741,7 +176172,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -174943,8 +176374,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -174952,19 +176383,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -174997,11 +176428,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -175009,11 +176445,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -175166,8 +176604,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -175240,7 +176678,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -175367,12 +176805,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -175491,12 +176929,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -175841,7 +177281,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -176043,8 +177483,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -176052,19 +177492,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -176097,11 +177537,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -176109,11 +177554,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -176266,8 +177713,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -176340,7 +177787,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -176467,12 +177914,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -176591,12 +178038,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -176941,7 +178390,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -177143,8 +178592,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -177152,19 +178601,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -177197,11 +178646,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -177209,11 +178663,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -177366,8 +178822,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -177440,7 +178896,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -177567,12 +179023,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -177691,12 +179147,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -178041,7 +179499,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -178243,8 +179701,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -178252,19 +179710,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -178297,11 +179755,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -178309,11 +179772,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -178466,8 +179931,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -178540,7 +180005,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -178667,12 +180132,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -178791,12 +180256,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -179141,7 +180608,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -179343,8 +180810,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -179352,19 +180819,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -179397,11 +180864,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -179409,11 +180881,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -179566,8 +181040,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -179640,7 +181114,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -179767,12 +181241,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -179891,12 +181365,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -180241,7 +181717,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -180443,8 +181919,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -180452,19 +181928,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -180497,11 +181973,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -180509,11 +181990,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -180666,8 +182149,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -180740,7 +182223,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -180867,12 +182350,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -180991,12 +182474,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -181341,7 +182826,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -181543,8 +183028,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -181552,19 +183037,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -181597,11 +183082,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -181609,11 +183099,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -181766,8 +183258,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -181840,7 +183332,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -181967,12 +183459,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -182091,12 +183583,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -182441,7 +183935,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -182643,8 +184137,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -182652,19 +184146,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -182697,11 +184191,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -182709,11 +184208,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -182866,8 +184367,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -182940,7 +184441,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -183067,12 +184568,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -183191,12 +184692,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -183541,7 +185044,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -183743,8 +185246,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -183752,19 +185255,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -183797,11 +185300,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -183809,11 +185317,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -183966,8 +185476,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -184040,7 +185550,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -184167,12 +185677,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -184291,12 +185801,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -184641,7 +186153,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -184843,8 +186355,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -184852,19 +186364,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -184897,11 +186409,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -184909,11 +186426,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -185066,8 +186585,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -185140,7 +186659,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -185267,12 +186786,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -185391,12 +186910,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -185741,7 +187262,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -185943,8 +187464,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -185952,19 +187473,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -185997,11 +187518,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -186009,11 +187535,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -186166,8 +187694,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -186240,7 +187768,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -186367,12 +187895,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -186491,12 +188019,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -186841,7 +188371,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -187043,8 +188573,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -187052,19 +188582,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -187097,11 +188627,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -187109,11 +188644,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -187266,8 +188803,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -187340,7 +188877,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -187467,12 +189004,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -187591,12 +189128,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -187941,7 +189480,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -188143,8 +189682,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -188152,19 +189691,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -188197,11 +189736,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -188209,11 +189753,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -188366,8 +189912,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -188440,7 +189986,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -188567,12 +190113,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -188691,12 +190237,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -189041,7 +190589,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -189243,8 +190791,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -189252,19 +190800,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -189297,11 +190845,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -189309,11 +190862,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -189466,8 +191021,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -189540,7 +191095,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -189667,12 +191222,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -189791,12 +191346,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -190141,7 +191698,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -190343,8 +191900,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -190352,19 +191909,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -190397,11 +191954,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -190409,11 +191971,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -190566,8 +192130,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -190640,7 +192204,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -190767,12 +192331,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -190891,12 +192455,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -191241,7 +192807,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -191443,8 +193009,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -191452,19 +193018,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -191497,11 +193063,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -191509,11 +193080,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -191666,8 +193239,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -191740,7 +193313,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -191867,12 +193440,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -191991,12 +193564,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -192341,7 +193916,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -192543,8 +194118,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -192552,19 +194127,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -192597,11 +194172,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -192609,11 +194189,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -192766,8 +194348,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -192840,7 +194422,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -192967,12 +194549,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -193091,12 +194673,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -193441,7 +195025,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -193643,8 +195227,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -193652,19 +195236,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -193697,11 +195281,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -193709,11 +195298,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -193866,8 +195457,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -193940,7 +195531,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -194067,12 +195658,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -194191,12 +195782,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -194541,7 +196134,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -194743,8 +196336,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -194752,19 +196345,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -194797,11 +196390,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -194809,11 +196407,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -194966,8 +196566,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -195040,7 +196640,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -195167,12 +196767,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -195291,12 +196891,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -195641,7 +197243,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -195843,8 +197445,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -195852,19 +197454,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -195897,11 +197499,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -195909,11 +197516,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -196066,8 +197675,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -196140,7 +197749,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -196267,12 +197876,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -196391,12 +198000,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -196741,7 +198352,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -196943,8 +198554,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -196952,19 +198563,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -196997,11 +198608,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -197009,11 +198625,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -197166,8 +198784,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -197240,7 +198858,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -197367,12 +198985,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -197491,12 +199109,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -197841,7 +199461,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -198043,8 +199663,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -198052,19 +199672,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -198097,11 +199717,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -198109,11 +199734,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -198266,8 +199893,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -198340,7 +199967,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -198467,12 +200094,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -198591,12 +200218,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -198941,7 +200570,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -199143,8 +200772,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -199152,19 +200781,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -199197,11 +200826,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -199209,11 +200843,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -199366,8 +201002,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -199440,7 +201076,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -199567,12 +201203,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -199691,12 +201327,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -200041,7 +201679,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -200243,8 +201881,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -200252,19 +201890,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -200297,11 +201935,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -200309,11 +201952,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -200466,8 +202111,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -200540,7 +202185,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -200667,12 +202312,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -200791,12 +202436,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -201141,7 +202788,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -201343,8 +202990,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -201352,19 +202999,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -201397,11 +203044,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -201409,11 +203061,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -201566,8 +203220,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -201640,7 +203294,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -201767,12 +203421,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -201891,12 +203545,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -202241,7 +203897,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -202443,8 +204099,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -202452,19 +204108,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -202497,11 +204153,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -202509,11 +204170,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -202666,8 +204329,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -202740,7 +204403,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -202867,12 +204530,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -202991,12 +204654,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -203341,7 +205006,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -203543,8 +205208,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -203552,19 +205217,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -203597,11 +205262,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -203609,11 +205279,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -203766,8 +205438,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -203840,7 +205512,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -203967,12 +205639,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -204091,12 +205763,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -204441,7 +206115,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -204643,8 +206317,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -204652,19 +206326,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -204697,11 +206371,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -204709,11 +206388,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -204866,8 +206547,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -204940,7 +206621,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -205067,12 +206748,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -205191,12 +206872,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -205541,7 +207224,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -205743,8 +207426,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -205752,19 +207435,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -205797,11 +207480,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -205809,11 +207497,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -205966,8 +207656,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -206040,7 +207730,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -206167,12 +207857,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -206291,12 +207981,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -206641,7 +208333,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -206843,8 +208535,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -206852,19 +208544,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -206897,11 +208589,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -206909,11 +208606,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -207066,8 +208765,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -207140,7 +208839,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -207267,12 +208966,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -207391,12 +209090,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -207741,7 +209442,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -207943,8 +209644,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -207952,19 +209653,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -207997,11 +209698,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -208009,11 +209715,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -208166,8 +209874,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -208240,7 +209948,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -208367,12 +210075,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -208491,12 +210199,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -208841,7 +210551,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -209043,8 +210753,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -209052,19 +210762,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -209097,11 +210807,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -209109,11 +210824,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -209266,8 +210983,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -209340,7 +211057,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -209467,12 +211184,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -209591,12 +211308,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -209941,7 +211660,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -210143,8 +211862,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -210152,19 +211871,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -210197,11 +211916,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -210209,11 +211933,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -210366,8 +212092,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -210440,7 +212166,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -210567,12 +212293,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -210691,12 +212417,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -211041,7 +212769,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -211243,8 +212971,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -211252,19 +212980,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -211297,11 +213025,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -211309,11 +213042,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -211466,8 +213201,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -211540,7 +213275,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -211667,12 +213402,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -211791,12 +213526,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -212141,7 +213878,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -212343,8 +214080,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -212352,19 +214089,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -212397,11 +214134,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -212409,11 +214151,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -212566,8 +214310,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -212640,7 +214384,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -212767,12 +214511,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -212891,12 +214635,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -213241,7 +214987,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -213443,8 +215189,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -213452,19 +215198,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -213497,11 +215243,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -213509,11 +215260,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -213666,8 +215419,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -213740,7 +215493,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -213867,12 +215620,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -213991,12 +215744,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -214341,7 +216096,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -214543,8 +216298,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -214552,19 +216307,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -214597,11 +216352,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -214609,11 +216369,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -214766,8 +216528,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -214840,7 +216602,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -214967,12 +216729,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -215091,12 +216853,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -215441,7 +217205,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -215643,8 +217407,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -215652,19 +217416,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -215697,11 +217461,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -215709,11 +217478,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -215866,8 +217637,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -215940,7 +217711,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -216067,12 +217838,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -216191,12 +217962,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -216541,7 +218314,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -216743,8 +218516,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -216752,19 +218525,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -216797,11 +218570,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -216809,11 +218587,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -216966,8 +218746,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -217040,7 +218820,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -217167,12 +218947,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -217291,12 +219071,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -217641,7 +219423,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -217843,8 +219625,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -217852,19 +219634,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -217897,11 +219679,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -217909,11 +219696,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -218066,8 +219855,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -218140,7 +219929,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -218267,12 +220056,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -218391,12 +220180,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -218741,7 +220532,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -218943,8 +220734,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -218952,19 +220743,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -218997,11 +220788,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -219009,11 +220805,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -219166,8 +220964,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -219240,7 +221038,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -219367,12 +221165,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -219491,12 +221289,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -219841,7 +221641,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -220043,8 +221843,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -220052,19 +221852,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -220097,11 +221897,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -220109,11 +221914,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -220266,8 +222073,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -220340,7 +222147,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -220467,12 +222274,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -220591,12 +222398,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -220941,7 +222750,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -221143,8 +222952,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -221152,19 +222961,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -221197,11 +223006,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -221209,11 +223023,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -221366,8 +223182,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -221440,7 +223256,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -221567,12 +223383,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -221691,12 +223507,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -222041,7 +223859,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -222243,8 +224061,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -222252,19 +224070,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -222297,11 +224115,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -222309,11 +224132,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -222466,8 +224291,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -222540,7 +224365,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -222667,12 +224492,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -222791,12 +224616,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -223141,7 +224968,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -223343,8 +225170,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -223352,19 +225179,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -223397,11 +225224,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -223409,11 +225241,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -223566,8 +225400,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -223640,7 +225474,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -223767,12 +225601,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -223891,12 +225725,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -224241,7 +226077,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -224443,8 +226279,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -224452,19 +226288,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -224497,11 +226333,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -224509,11 +226350,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -224666,8 +226509,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -224740,7 +226583,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -224867,12 +226710,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -224991,12 +226834,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -225341,7 +227186,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -225543,8 +227388,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -225552,19 +227397,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -225597,11 +227442,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -225609,11 +227459,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -225766,8 +227618,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -225840,7 +227692,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -225967,12 +227819,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -226091,12 +227943,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -226441,7 +228295,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -226643,8 +228497,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -226652,19 +228506,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -226697,11 +228551,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -226709,11 +228568,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -226866,8 +228727,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -226940,7 +228801,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -227067,12 +228928,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -227191,12 +229052,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -227541,7 +229404,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -227743,8 +229606,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -227752,19 +229615,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -227797,11 +229660,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -227809,11 +229677,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -227966,8 +229836,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -228040,7 +229910,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -228167,12 +230037,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -228291,12 +230161,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -228641,7 +230513,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -228843,8 +230715,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -228852,19 +230724,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -228897,11 +230769,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -228909,11 +230786,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -229066,8 +230945,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -229140,7 +231019,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -229267,12 +231146,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -229391,12 +231270,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -229741,7 +231622,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -229943,8 +231824,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -229952,19 +231833,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -229997,11 +231878,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -230009,11 +231895,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -230166,8 +232054,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -230240,7 +232128,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -230367,12 +232255,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -230491,12 +232379,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -230841,7 +232731,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -231043,8 +232933,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -231052,19 +232942,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -231097,11 +232987,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -231109,11 +233004,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -231266,8 +233163,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -231340,7 +233237,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -231467,12 +233364,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -231591,12 +233488,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -231941,7 +233840,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -232143,8 +234042,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -232152,19 +234051,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -232197,11 +234096,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -232209,11 +234113,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -232366,8 +234272,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -232440,7 +234346,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -232567,12 +234473,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -232691,12 +234597,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -233041,7 +234949,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -233243,8 +235151,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -233252,19 +235160,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -233297,11 +235205,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -233309,11 +235222,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -233466,8 +235381,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -233540,7 +235455,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -233667,12 +235582,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -233791,12 +235706,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -234141,7 +236058,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -234343,8 +236260,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -234352,19 +236269,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -234397,11 +236314,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -234409,11 +236331,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -234566,8 +236490,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -234640,7 +236564,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -234767,12 +236691,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -234891,12 +236815,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -235241,7 +237167,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -235443,8 +237369,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -235452,19 +237378,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -235497,11 +237423,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -235509,11 +237440,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -235666,8 +237599,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -235740,7 +237673,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -235867,12 +237800,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -235991,12 +237924,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -236341,7 +238276,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -236543,8 +238478,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -236552,19 +238487,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -236597,11 +238532,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -236609,11 +238549,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -236766,8 +238708,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -236840,7 +238782,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -236967,12 +238909,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -237091,12 +239033,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -237441,7 +239385,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -237643,8 +239587,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -237652,19 +239596,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -237697,11 +239641,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -237709,11 +239658,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -237866,8 +239817,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -237940,7 +239891,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -238067,12 +240018,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -238191,12 +240142,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -238541,7 +240494,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -238743,8 +240696,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -238752,19 +240705,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -238797,11 +240750,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -238809,11 +240767,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -238966,8 +240926,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -239040,7 +241000,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -239167,12 +241127,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -239291,12 +241251,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -239641,7 +241603,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -239843,8 +241805,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -239852,19 +241814,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -239897,11 +241859,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -239909,11 +241876,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -240066,8 +242035,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -240140,7 +242109,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -240267,12 +242236,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -240391,12 +242360,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -240741,7 +242712,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -240943,8 +242914,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -240952,19 +242923,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -240997,11 +242968,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -241009,11 +242985,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -241166,8 +243144,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -241240,7 +243218,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -241367,12 +243345,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -241491,12 +243469,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -241841,7 +243821,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -242043,8 +244023,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -242052,19 +244032,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -242097,11 +244077,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -242109,11 +244094,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -242266,8 +244253,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -242340,7 +244327,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -242467,12 +244454,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -242591,12 +244578,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -242941,7 +244930,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -243143,8 +245132,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -243152,19 +245141,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -243197,11 +245186,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -243209,11 +245203,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -243366,8 +245362,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -243440,7 +245436,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -243567,12 +245563,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -243691,12 +245687,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -244041,7 +246039,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -244243,8 +246241,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -244252,19 +246250,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -244297,11 +246295,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -244309,11 +246312,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -244466,8 +246471,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -244540,7 +246545,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -244667,12 +246672,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -244791,12 +246796,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -245141,7 +247148,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -245343,8 +247350,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -245352,19 +247359,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -245397,11 +247404,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -245409,11 +247421,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -245566,8 +247580,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -245640,7 +247654,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -245767,12 +247781,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -245891,12 +247905,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -246241,7 +248257,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -246443,8 +248459,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -246452,19 +248468,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -246497,11 +248513,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -246509,11 +248530,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -246666,8 +248689,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -246740,7 +248763,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -246867,12 +248890,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -246991,12 +249014,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -247341,7 +249366,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -247543,8 +249568,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -247552,19 +249577,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -247597,11 +249622,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -247609,11 +249639,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -247766,8 +249798,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -247840,7 +249872,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -247967,12 +249999,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -248091,12 +250123,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -248441,7 +250475,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -248643,8 +250677,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -248652,19 +250686,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -248697,11 +250731,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -248709,11 +250748,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -248866,8 +250907,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -248940,7 +250981,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -249067,12 +251108,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -249191,12 +251232,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -249541,7 +251584,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -249743,8 +251786,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -249752,19 +251795,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -249797,11 +251840,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -249809,11 +251857,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -249966,8 +252016,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -250040,7 +252090,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -250167,12 +252217,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -250291,12 +252341,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -250641,7 +252693,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -250843,8 +252895,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -250852,19 +252904,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -250897,11 +252949,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -250909,11 +252966,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -251066,8 +253125,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -251140,7 +253199,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -251267,12 +253326,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -251391,12 +253450,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -251741,7 +253802,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -251943,8 +254004,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -251952,19 +254013,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -251997,11 +254058,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -252009,11 +254075,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -252166,8 +254234,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -252240,7 +254308,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -252367,12 +254435,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -252491,12 +254559,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -252841,7 +254911,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -253043,8 +255113,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -253052,19 +255122,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -253097,11 +255167,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -253109,11 +255184,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -253266,8 +255343,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -253340,7 +255417,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -253467,12 +255544,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -253591,12 +255668,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -253941,7 +256020,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -254143,8 +256222,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -254152,19 +256231,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -254197,11 +256276,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -254209,11 +256293,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -254366,8 +256452,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -254440,7 +256526,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -254567,12 +256653,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -254691,12 +256777,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -255041,7 +257129,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -255243,8 +257331,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -255252,19 +257340,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -255297,11 +257385,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -255309,11 +257402,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -255466,8 +257561,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -255540,7 +257635,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -255667,12 +257762,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -255791,12 +257886,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -256141,7 +258238,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -256343,8 +258440,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -256352,19 +258449,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -256397,11 +258494,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -256409,11 +258511,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -256566,8 +258670,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -256640,7 +258744,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -256767,12 +258871,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -256891,12 +258995,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -257241,7 +259347,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -257443,8 +259549,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -257452,19 +259558,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -257497,11 +259603,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -257509,11 +259620,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -257666,8 +259779,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -257740,7 +259853,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -257867,12 +259980,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -257991,12 +260104,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -258341,7 +260456,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -258543,8 +260658,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -258552,19 +260667,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -258597,11 +260712,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -258609,11 +260729,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -258766,8 +260888,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -258840,7 +260962,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -258967,12 +261089,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -259091,12 +261213,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -259441,7 +261565,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -259643,8 +261767,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -259652,19 +261776,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -259697,11 +261821,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -259709,11 +261838,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -259866,8 +261997,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -259940,7 +262071,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -260067,12 +262198,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -260191,12 +262322,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -260541,7 +262674,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -260743,8 +262876,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -260752,19 +262885,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -260797,11 +262930,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -260809,11 +262947,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -260966,8 +263106,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -261040,7 +263180,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -261167,12 +263307,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -261291,12 +263431,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -261641,7 +263783,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -261843,8 +263985,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -261852,19 +263994,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -261897,11 +264039,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -261909,11 +264056,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -262066,8 +264215,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -262140,7 +264289,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -262267,12 +264416,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -262391,12 +264540,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -262741,7 +264892,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -262943,8 +265094,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -262952,19 +265103,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -262997,11 +265148,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -263009,11 +265165,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -263166,8 +265324,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -263240,7 +265398,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -263367,12 +265525,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -263491,12 +265649,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -263841,7 +266001,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -264043,8 +266203,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -264052,19 +266212,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -264097,11 +266257,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -264109,11 +266274,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -264266,8 +266433,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -264340,7 +266507,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -264467,12 +266634,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -264591,12 +266758,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -264941,7 +267110,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -265143,8 +267312,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -265152,19 +267321,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -265197,11 +267366,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -265209,11 +267383,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -265366,8 +267542,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -265440,7 +267616,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -265567,12 +267743,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -265691,12 +267867,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -266041,7 +268219,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -266243,8 +268421,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -266252,19 +268430,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -266297,11 +268475,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -266309,11 +268492,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -266466,8 +268651,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -266540,7 +268725,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -266667,12 +268852,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -266791,12 +268976,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -267141,7 +269328,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -267343,8 +269530,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -267352,19 +269539,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -267397,11 +269584,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -267409,11 +269601,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -267566,8 +269760,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -267640,7 +269834,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -267767,12 +269961,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -267891,12 +270085,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -268241,7 +270437,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -268443,8 +270639,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -268452,19 +270648,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -268497,11 +270693,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -268509,11 +270710,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -268666,8 +270869,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -268740,7 +270943,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -268867,12 +271070,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -268991,12 +271194,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -269341,7 +271546,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -269543,8 +271748,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -269552,19 +271757,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -269597,11 +271802,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -269609,11 +271819,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -269766,8 +271978,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -269840,7 +272052,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -269967,12 +272179,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -270091,12 +272303,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -270441,7 +272655,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -270643,8 +272857,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -270652,19 +272866,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -270697,11 +272911,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -270709,11 +272928,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -270866,8 +273087,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -270940,7 +273161,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -271067,12 +273288,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -271191,12 +273412,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -271541,7 +273764,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -271743,8 +273966,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -271752,19 +273975,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -271797,11 +274020,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -271809,11 +274037,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -271966,8 +274196,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -272040,7 +274270,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -272167,12 +274397,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -272291,12 +274521,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -272641,7 +274873,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -272843,8 +275075,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -272852,19 +275084,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -272897,11 +275129,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -272909,11 +275146,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -273066,8 +275305,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -273140,7 +275379,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -273267,12 +275506,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -273391,12 +275630,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -273741,7 +275982,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -273943,8 +276184,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -273952,19 +276193,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -273997,11 +276238,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -274009,11 +276255,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -274166,8 +276414,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -274240,7 +276488,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -274367,12 +276615,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -274491,12 +276739,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -274841,7 +277091,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -275043,8 +277293,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -275052,19 +277302,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -275097,11 +277347,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -275109,11 +277364,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -275266,8 +277523,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -275340,7 +277597,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -275467,12 +277724,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -275591,12 +277848,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -275941,7 +278200,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -276143,8 +278402,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -276152,19 +278411,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -276197,11 +278456,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -276209,11 +278473,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -276366,8 +278632,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -276440,7 +278706,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -276567,12 +278833,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -276691,12 +278957,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -277041,7 +279309,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -277243,8 +279511,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -277252,19 +279520,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -277297,11 +279565,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -277309,11 +279582,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -277466,8 +279741,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -277540,7 +279815,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -277667,12 +279942,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -277791,12 +280066,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -278141,7 +280418,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -278343,8 +280620,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -278352,19 +280629,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -278397,11 +280674,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -278409,11 +280691,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -278566,8 +280850,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -278640,7 +280924,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -278767,12 +281051,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -278891,12 +281175,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -279241,7 +281527,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -279443,8 +281729,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -279452,19 +281738,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -279497,11 +281783,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -279509,11 +281800,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -279666,8 +281959,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -279740,7 +282033,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -279867,12 +282160,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -279991,12 +282284,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -280341,7 +282636,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -280543,8 +282838,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -280552,19 +282847,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -280597,11 +282892,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -280609,11 +282909,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -280766,8 +283068,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -280840,7 +283142,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -280967,12 +283269,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -281091,12 +283393,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -281441,7 +283745,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -281643,8 +283947,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -281652,19 +283956,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -281697,11 +284001,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -281709,11 +284018,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -281866,8 +284177,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -281940,7 +284251,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -282067,12 +284378,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -282191,12 +284502,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -282541,7 +284854,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -282743,8 +285056,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -282752,19 +285065,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -282797,11 +285110,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -282809,11 +285127,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -282966,8 +285286,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -283040,7 +285360,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -283167,12 +285487,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -283291,12 +285611,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -283641,7 +285963,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -283843,8 +286165,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -283852,19 +286174,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -283897,11 +286219,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -283909,11 +286236,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -284066,8 +286395,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -284140,7 +286469,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -284267,12 +286596,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -284391,12 +286720,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -284741,7 +287072,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -284943,8 +287274,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -284952,19 +287283,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -284997,11 +287328,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -285009,11 +287345,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -285166,8 +287504,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -285240,7 +287578,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -285367,12 +287705,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -285491,12 +287829,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -285841,7 +288181,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -286043,8 +288383,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -286052,19 +288392,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -286097,11 +288437,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -286109,11 +288454,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -286266,8 +288613,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -286340,7 +288687,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -286467,12 +288814,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -286591,12 +288938,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -286941,7 +289290,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -287143,8 +289492,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -287152,19 +289501,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -287197,11 +289546,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -287209,11 +289563,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -287366,8 +289722,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -287440,7 +289796,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -287567,12 +289923,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -287691,12 +290047,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -288041,7 +290399,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -288243,8 +290601,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -288252,19 +290610,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -288297,11 +290655,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -288309,11 +290672,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -288466,8 +290831,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -288540,7 +290905,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -288667,12 +291032,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -288791,12 +291156,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -289141,7 +291508,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -289343,8 +291710,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -289352,19 +291719,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -289397,11 +291764,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -289409,11 +291781,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -289566,8 +291940,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -289640,7 +292014,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -289767,12 +292141,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -289891,12 +292265,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -290241,7 +292617,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -290443,8 +292819,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -290452,19 +292828,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -290497,11 +292873,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -290509,11 +292890,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -290666,8 +293049,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -290740,7 +293123,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -290867,12 +293250,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -290991,12 +293374,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -291341,7 +293726,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -291543,8 +293928,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -291552,19 +293937,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -291597,11 +293982,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -291609,11 +293999,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -291766,8 +294158,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -291840,7 +294232,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -291967,12 +294359,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -292091,12 +294483,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -292441,7 +294835,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -292643,8 +295037,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -292652,19 +295046,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -292697,11 +295091,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -292709,11 +295108,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -292866,8 +295267,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -292940,7 +295341,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -293067,12 +295468,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -293191,12 +295592,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -293541,7 +295944,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -293743,8 +296146,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -293752,19 +296155,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -293797,11 +296200,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -293809,11 +296217,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -293966,8 +296376,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -294040,7 +296450,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -294167,12 +296577,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -294291,12 +296701,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -294641,7 +297053,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -294843,8 +297255,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -294852,19 +297264,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -294897,11 +297309,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -294909,11 +297326,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -295066,8 +297485,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -295140,7 +297559,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -295267,12 +297686,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -295391,12 +297810,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -295741,7 +298162,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -295943,8 +298364,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -295952,19 +298373,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -295997,11 +298418,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -296009,11 +298435,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -296166,8 +298594,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -296240,7 +298668,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -296367,12 +298795,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -296491,12 +298919,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -296841,7 +299271,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -297043,8 +299473,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -297052,19 +299482,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -297097,11 +299527,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -297109,11 +299544,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -297266,8 +299703,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -297340,7 +299777,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -297467,12 +299904,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -297591,12 +300028,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -297941,7 +300380,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -298143,8 +300582,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -298152,19 +300591,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -298197,11 +300636,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -298209,11 +300653,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -298366,8 +300812,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -298440,7 +300886,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -298567,12 +301013,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -298691,12 +301137,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -299041,7 +301489,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -299243,8 +301691,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -299252,19 +301700,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -299297,11 +301745,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -299309,11 +301762,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -299466,8 +301921,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -299540,7 +301995,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -299667,12 +302122,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -299791,12 +302246,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -300141,7 +302598,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -300343,8 +302800,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -300352,19 +302809,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -300397,11 +302854,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -300409,11 +302871,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -300566,8 +303030,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -300640,7 +303104,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -300767,12 +303231,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -300891,12 +303355,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -301241,7 +303707,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -301443,8 +303909,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -301452,19 +303918,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -301497,11 +303963,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -301509,11 +303980,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -301666,8 +304139,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -301740,7 +304213,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -301867,12 +304340,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -301991,12 +304464,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -302341,7 +304816,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -302543,8 +305018,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -302552,19 +305027,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -302597,11 +305072,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -302609,11 +305089,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -302766,8 +305248,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -302840,7 +305322,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -302967,12 +305449,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -303091,12 +305573,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -303441,7 +305925,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -303643,8 +306127,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -303652,19 +306136,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -303697,11 +306181,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -303709,11 +306198,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -303866,8 +306357,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -303940,7 +306431,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -304067,12 +306558,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -304191,12 +306682,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -304541,7 +307034,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -304743,8 +307236,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -304752,19 +307245,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -304797,11 +307290,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -304809,11 +307307,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -304966,8 +307466,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -305040,7 +307540,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -305167,12 +307667,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -305291,12 +307791,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -305641,7 +308143,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -305843,8 +308345,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -305852,19 +308354,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -305897,11 +308399,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -305909,11 +308416,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -306066,8 +308575,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -306140,7 +308649,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -306267,12 +308776,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -306391,12 +308900,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -306741,7 +309252,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -306943,8 +309454,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -306952,19 +309463,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -306997,11 +309508,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -307009,11 +309525,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -307166,8 +309684,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -307240,7 +309758,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -307367,12 +309885,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -307491,12 +310009,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -307841,7 +310361,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -308043,8 +310563,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -308052,19 +310572,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -308097,11 +310617,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -308109,11 +310634,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -308266,8 +310793,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -308340,7 +310867,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -308467,12 +310994,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -308591,12 +311118,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -308941,7 +311470,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -309143,8 +311672,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -309152,19 +311681,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -309197,11 +311726,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -309209,11 +311743,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -309366,8 +311902,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -309440,7 +311976,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -309567,12 +312103,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -309691,12 +312227,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -310041,7 +312579,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -310243,8 +312781,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -310252,19 +312790,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -310297,11 +312835,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -310309,11 +312852,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -310466,8 +313011,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -310540,7 +313085,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -310667,12 +313212,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -310791,12 +313336,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -311141,7 +313688,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -311343,8 +313890,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -311352,19 +313899,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -311397,11 +313944,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -311409,11 +313961,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -311566,8 +314120,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -311640,7 +314194,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -311767,12 +314321,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -311891,12 +314445,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -312241,7 +314797,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -312443,8 +314999,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -312452,19 +315008,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -312497,11 +315053,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -312509,11 +315070,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -312666,8 +315229,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -312740,7 +315303,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -312867,12 +315430,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -312991,12 +315554,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -313341,7 +315906,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -313543,8 +316108,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -313552,19 +316117,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -313597,11 +316162,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -313609,11 +316179,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -313766,8 +316338,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -313840,7 +316412,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -313967,12 +316539,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -314091,12 +316663,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -314441,7 +317015,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -314643,8 +317217,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -314652,19 +317226,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -314697,11 +317271,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -314709,11 +317288,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -314866,8 +317447,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -314940,7 +317521,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -315067,12 +317648,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -315191,12 +317772,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -315541,7 +318124,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -315743,8 +318326,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -315752,19 +318335,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -315797,11 +318380,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -315809,11 +318397,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -315966,8 +318556,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -316040,7 +318630,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -316167,12 +318757,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -316291,12 +318881,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -316641,7 +319233,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -316843,8 +319435,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -316852,19 +319444,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -316897,11 +319489,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -316909,11 +319506,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -317066,8 +319665,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -317140,7 +319739,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -317267,12 +319866,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -317391,12 +319990,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -317741,7 +320342,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -317943,8 +320544,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -317952,19 +320553,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -317997,11 +320598,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -318009,11 +320615,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -318166,8 +320774,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -318240,7 +320848,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -318367,12 +320975,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -318491,12 +321099,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -318841,7 +321451,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -319043,8 +321653,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -319052,19 +321662,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -319097,11 +321707,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -319109,11 +321724,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -319266,8 +321883,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -319340,7 +321957,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -319467,12 +322084,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -319591,12 +322208,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -319941,7 +322560,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -320143,8 +322762,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -320152,19 +322771,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -320197,11 +322816,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -320209,11 +322833,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -320366,8 +322992,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -320440,7 +323066,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -320567,12 +323193,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -320691,12 +323317,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -321041,7 +323669,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -321243,8 +323871,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -321252,19 +323880,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -321297,11 +323925,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -321309,11 +323942,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -321466,8 +324101,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -321540,7 +324175,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -321667,12 +324302,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -321791,12 +324426,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -322141,7 +324778,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -322343,8 +324980,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -322352,19 +324989,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -322397,11 +325034,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -322409,11 +325051,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -322566,8 +325210,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -322640,7 +325284,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -322767,12 +325411,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -322891,12 +325535,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -323241,7 +325887,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -323443,8 +326089,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -323452,19 +326098,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -323497,11 +326143,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -323509,11 +326160,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -323666,8 +326319,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -323740,7 +326393,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -323867,12 +326520,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -323991,12 +326644,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -324341,7 +326996,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -324543,8 +327198,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -324552,19 +327207,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -324597,11 +327252,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -324609,11 +327269,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -324766,8 +327428,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -324840,7 +327502,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -324967,12 +327629,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -325091,12 +327753,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -325441,7 +328105,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -325643,8 +328307,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -325652,19 +328316,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -325697,11 +328361,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -325709,11 +328378,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -325866,8 +328537,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -325940,7 +328611,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -326067,12 +328738,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -326191,12 +328862,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -326541,7 +329214,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -326743,8 +329416,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -326752,19 +329425,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -326797,11 +329470,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -326809,11 +329487,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -326966,8 +329646,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -327040,7 +329720,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -327167,12 +329847,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -327291,12 +329971,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -327641,7 +330323,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -327843,8 +330525,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -327852,19 +330534,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -327897,11 +330579,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -327909,11 +330596,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -328066,8 +330755,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -328140,7 +330829,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -328267,12 +330956,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -328391,12 +331080,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -328741,7 +331432,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -328943,8 +331634,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -328952,19 +331643,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -328997,11 +331688,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -329009,11 +331705,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -329166,8 +331864,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -329240,7 +331938,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -329367,12 +332065,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -329491,12 +332189,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -329841,7 +332541,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -330043,8 +332743,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -330052,19 +332752,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -330097,11 +332797,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -330109,11 +332814,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -330266,8 +332973,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -330340,7 +333047,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -330467,12 +333174,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -330591,12 +333298,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -330941,7 +333650,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -331143,8 +333852,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -331152,19 +333861,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -331197,11 +333906,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -331209,11 +333923,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -331366,8 +334082,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -331440,7 +334156,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -331567,12 +334283,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -331691,12 +334407,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -332041,7 +334759,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -332243,8 +334961,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -332252,19 +334970,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -332297,11 +335015,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -332309,11 +335032,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -332466,8 +335191,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -332540,7 +335265,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -332667,12 +335392,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -332791,12 +335516,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -333141,7 +335868,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -333343,8 +336070,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -333352,19 +336079,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -333397,11 +336124,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -333409,11 +336141,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -333566,8 +336300,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -333640,7 +336374,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -333767,12 +336501,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -333891,12 +336625,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -334241,7 +336977,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -334443,8 +337179,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -334452,19 +337188,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -334497,11 +337233,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -334509,11 +337250,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -334666,8 +337409,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -334740,7 +337483,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -334867,12 +337610,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -334991,12 +337734,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -335341,7 +338086,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -335543,8 +338288,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -335552,19 +338297,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -335597,11 +338342,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -335609,11 +338359,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -335766,8 +338518,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -335840,7 +338592,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -335967,12 +338719,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -336091,12 +338843,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -336441,7 +339195,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -336643,8 +339397,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -336652,19 +339406,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -336697,11 +339451,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -336709,11 +339468,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -336866,8 +339627,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -336940,7 +339701,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -337067,12 +339828,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -337191,12 +339952,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -337541,7 +340304,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -337743,8 +340506,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -337752,19 +340515,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -337797,11 +340560,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -337809,11 +340577,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -337966,8 +340736,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -338040,7 +340810,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -338167,12 +340937,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -338291,12 +341061,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -338641,7 +341413,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -338843,8 +341615,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -338852,19 +341624,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -338897,11 +341669,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -338909,11 +341686,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -339066,8 +341845,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -339140,7 +341919,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -339267,12 +342046,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -339391,12 +342170,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -339741,7 +342522,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -339943,8 +342724,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -339952,19 +342733,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -339997,11 +342778,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -340009,11 +342795,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -340166,8 +342954,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -340240,7 +343028,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -340367,12 +343155,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -340491,12 +343279,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -340841,7 +343631,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -341043,8 +343833,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -341052,19 +343842,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -341097,11 +343887,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -341109,11 +343904,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -341266,8 +344063,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -341340,7 +344137,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -341467,12 +344264,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -341591,12 +344388,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -341941,7 +344740,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -342143,8 +344942,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -342152,19 +344951,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -342197,11 +344996,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -342209,11 +345013,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -342366,8 +345172,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -342440,7 +345246,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -342567,12 +345373,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -342691,12 +345497,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -343041,7 +345849,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -343243,8 +346051,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -343252,19 +346060,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -343297,11 +346105,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -343309,11 +346122,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -343466,8 +346281,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -343540,7 +346355,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -343667,12 +346482,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -343791,12 +346606,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -344141,7 +346958,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -344343,8 +347160,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -344352,19 +347169,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -344397,11 +347214,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -344409,11 +347231,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -344566,8 +347390,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -344640,7 +347464,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -344767,12 +347591,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -344891,12 +347715,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -345241,7 +348067,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -345443,8 +348269,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -345452,19 +348278,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -345497,11 +348323,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -345509,11 +348340,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -345666,8 +348499,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -345740,7 +348573,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -345867,12 +348700,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -345991,12 +348824,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -346341,7 +349176,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -346543,8 +349378,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -346552,19 +349387,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -346597,11 +349432,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -346609,11 +349449,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -346766,8 +349608,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -346840,7 +349682,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -346967,12 +349809,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -347091,12 +349933,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -347441,7 +350285,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -347643,8 +350487,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -347652,19 +350496,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -347697,11 +350541,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -347709,11 +350558,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -347866,8 +350717,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -347940,7 +350791,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -348067,12 +350918,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -348191,12 +351042,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -348541,7 +351394,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -348743,8 +351596,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -348752,19 +351605,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -348797,11 +351650,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -348809,11 +351667,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -348966,8 +351826,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -349040,7 +351900,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -349167,12 +352027,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -349291,12 +352151,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -349641,7 +352503,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -349843,8 +352705,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -349852,19 +352714,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -349897,11 +352759,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -349909,11 +352776,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -350066,8 +352935,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -350140,7 +353009,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -350267,12 +353136,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -350391,12 +353260,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -350741,7 +353612,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -350943,8 +353814,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -350952,19 +353823,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -350997,11 +353868,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -351009,11 +353885,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -351166,8 +354044,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -351240,7 +354118,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -351367,12 +354245,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -351491,12 +354369,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -351841,7 +354721,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -352043,8 +354923,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -352052,19 +354932,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -352097,11 +354977,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -352109,11 +354994,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -352266,8 +355153,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -352340,7 +355227,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -352467,12 +355354,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -352591,12 +355478,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -352941,7 +355830,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -353143,8 +356032,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -353152,19 +356041,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -353197,11 +356086,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -353209,11 +356103,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -353366,8 +356262,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -353440,7 +356336,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -353567,12 +356463,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -353691,12 +356587,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -354041,7 +356939,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -354243,8 +357141,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -354252,19 +357150,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -354297,11 +357195,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -354309,11 +357212,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -354466,8 +357371,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -354540,7 +357445,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -354667,12 +357572,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -354791,12 +357696,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -355141,7 +358048,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -355343,8 +358250,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -355352,19 +358259,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -355397,11 +358304,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -355409,11 +358321,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -355566,8 +358480,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -355640,7 +358554,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -355767,12 +358681,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -355891,12 +358805,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -356241,7 +359157,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -356443,8 +359359,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -356452,19 +359368,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -356497,11 +359413,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -356509,11 +359430,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -356666,8 +359589,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -356740,7 +359663,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -356867,12 +359790,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -356991,12 +359914,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -357341,7 +360266,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -357543,8 +360468,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -357552,19 +360477,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -357597,11 +360522,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -357609,11 +360539,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -357766,8 +360698,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -357840,7 +360772,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -357967,12 +360899,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -358091,12 +361023,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -358441,7 +361375,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -358643,8 +361577,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -358652,19 +361586,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -358697,11 +361631,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -358709,11 +361648,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -358866,8 +361807,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -358940,7 +361881,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -359067,12 +362008,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -359191,12 +362132,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -359541,7 +362484,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -359743,8 +362686,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -359752,19 +362695,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -359797,11 +362740,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -359809,11 +362757,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -359966,8 +362916,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -360040,7 +362990,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -360167,12 +363117,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -360291,12 +363241,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -360641,7 +363593,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -360843,8 +363795,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -360852,19 +363804,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -360897,11 +363849,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -360909,11 +363866,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -361066,8 +364025,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -361140,7 +364099,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -361267,12 +364226,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -361391,12 +364350,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -361741,7 +364702,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -361943,8 +364904,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -361952,19 +364913,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -361997,11 +364958,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -362009,11 +364975,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -362166,8 +365134,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -362240,7 +365208,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -362367,12 +365335,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -362491,12 +365459,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -362841,7 +365811,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -363043,8 +366013,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -363052,19 +366022,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -363097,11 +366067,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -363109,11 +366084,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -363266,8 +366243,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -363340,7 +366317,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -363467,12 +366444,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -363591,12 +366568,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -363941,7 +366920,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -364143,8 +367122,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -364152,19 +367131,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -364197,11 +367176,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -364209,11 +367193,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -364366,8 +367352,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -364440,7 +367426,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -364567,12 +367553,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -364691,12 +367677,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -365041,7 +368029,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -365243,8 +368231,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -365252,19 +368240,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -365297,11 +368285,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -365309,11 +368302,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -365466,8 +368461,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -365540,7 +368535,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -365667,12 +368662,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -365791,12 +368786,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -366141,7 +369138,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -366343,8 +369340,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -366352,19 +369349,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -366397,11 +369394,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -366409,11 +369411,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -366566,8 +369570,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -366640,7 +369644,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -366767,12 +369771,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -366891,12 +369895,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -367241,7 +370247,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -367443,8 +370449,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -367452,19 +370458,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -367497,11 +370503,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -367509,11 +370520,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -367666,8 +370679,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -367740,7 +370753,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -367867,12 +370880,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -367991,12 +371004,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -368341,7 +371356,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -368543,8 +371558,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -368552,19 +371567,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -368597,11 +371612,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -368609,11 +371629,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -368766,8 +371788,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -368840,7 +371862,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -368967,12 +371989,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -369091,12 +372113,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -369441,7 +372465,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -369643,8 +372667,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -369652,19 +372676,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -369697,11 +372721,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -369709,11 +372738,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -369866,8 +372897,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -369940,7 +372971,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -370067,12 +373098,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -370191,12 +373222,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -370541,7 +373574,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -370743,8 +373776,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -370752,19 +373785,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -370797,11 +373830,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -370809,11 +373847,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -370966,8 +374006,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -371040,7 +374080,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -371167,12 +374207,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -371291,12 +374331,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -371641,7 +374683,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -371843,8 +374885,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -371852,19 +374894,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -371897,11 +374939,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -371909,11 +374956,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -372066,8 +375115,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -372140,7 +375189,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -372267,12 +375316,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -372391,12 +375440,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -372741,7 +375792,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -372943,8 +375994,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -372952,19 +376003,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -372997,11 +376048,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -373009,11 +376065,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -373166,8 +376224,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -373240,7 +376298,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -373367,12 +376425,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -373491,12 +376549,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -373841,7 +376901,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -374043,8 +377103,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -374052,19 +377112,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -374097,11 +377157,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -374109,11 +377174,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -374266,8 +377333,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -374340,7 +377407,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -374467,12 +377534,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -374591,12 +377658,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -374941,7 +378010,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -375143,8 +378212,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -375152,19 +378221,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -375197,11 +378266,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -375209,11 +378283,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -375366,8 +378442,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -375440,7 +378516,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -375567,12 +378643,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -375691,12 +378767,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -376041,7 +379119,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -376243,8 +379321,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -376252,19 +379330,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -376297,11 +379375,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -376309,11 +379392,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -376466,8 +379551,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -376540,7 +379625,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -376667,12 +379752,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -376791,12 +379876,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -377141,7 +380228,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -377343,8 +380430,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -377352,19 +380439,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -377397,11 +380484,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -377409,11 +380501,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -377566,8 +380660,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -377640,7 +380734,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -377767,12 +380861,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -377891,12 +380985,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -378241,7 +381337,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -378443,8 +381539,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -378452,19 +381548,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -378497,11 +381593,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -378509,11 +381610,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -378666,8 +381769,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -378740,7 +381843,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -378867,12 +381970,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -378991,12 +382094,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -379341,7 +382446,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -379543,8 +382648,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -379552,19 +382657,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -379597,11 +382702,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -379609,11 +382719,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -379766,8 +382878,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -379840,7 +382952,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -379967,12 +383079,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -380091,12 +383203,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -380441,7 +383555,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -380643,8 +383757,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -380652,19 +383766,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -380697,11 +383811,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -380709,11 +383828,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -380866,8 +383987,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -380940,7 +384061,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -381067,12 +384188,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -381191,12 +384312,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -381541,7 +384664,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -381743,8 +384866,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -381752,19 +384875,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -381797,11 +384920,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -381809,11 +384937,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -381966,8 +385096,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -382040,7 +385170,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -382167,12 +385297,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -382291,12 +385421,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -382641,7 +385773,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -382843,8 +385975,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -382852,19 +385984,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -382897,11 +386029,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -382909,11 +386046,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -383066,8 +386205,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -383140,7 +386279,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -383267,12 +386406,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -383391,12 +386530,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -383741,7 +386882,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -383943,8 +387084,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -383952,19 +387093,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -383997,11 +387138,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -384009,11 +387155,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -384166,8 +387314,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -384240,7 +387388,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -384367,12 +387515,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -384491,12 +387639,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -384841,7 +387991,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -385043,8 +388193,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -385052,19 +388202,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -385097,11 +388247,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -385109,11 +388264,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -385266,8 +388423,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -385340,7 +388497,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -385467,12 +388624,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -385591,12 +388748,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -385941,7 +389100,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -386143,8 +389302,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -386152,19 +389311,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -386197,11 +389356,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -386209,11 +389373,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -386366,8 +389532,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -386440,7 +389606,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -386567,12 +389733,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -386691,12 +389857,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -387041,7 +390209,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -387243,8 +390411,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -387252,19 +390420,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -387297,11 +390465,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -387309,11 +390482,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -387466,8 +390641,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -387540,7 +390715,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -387667,12 +390842,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -387791,12 +390966,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -388141,7 +391318,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -388343,8 +391520,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -388352,19 +391529,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -388397,11 +391574,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -388409,11 +391591,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -388566,8 +391750,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -388640,7 +391824,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -388767,12 +391951,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -388891,12 +392075,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -389241,7 +392427,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -389443,8 +392629,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -389452,19 +392638,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -389497,11 +392683,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -389509,11 +392700,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -389666,8 +392859,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -389740,7 +392933,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -389867,12 +393060,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -389991,12 +393184,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -390341,7 +393536,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -390543,8 +393738,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -390552,19 +393747,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -390597,11 +393792,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -390609,11 +393809,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -390766,8 +393968,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -390840,7 +394042,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -390967,12 +394169,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -391091,12 +394293,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -391441,7 +394645,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -391643,8 +394847,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -391652,19 +394856,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -391697,11 +394901,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -391709,11 +394918,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -391866,8 +395077,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -391940,7 +395151,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -392067,12 +395278,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -392191,12 +395402,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -392541,7 +395754,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -392743,8 +395956,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -392752,19 +395965,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -392797,11 +396010,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -392809,11 +396027,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -392966,8 +396186,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -393040,7 +396260,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -393167,12 +396387,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -393291,12 +396511,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -393641,7 +396863,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -393843,8 +397065,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -393852,19 +397074,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -393897,11 +397119,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -393909,11 +397136,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -394066,8 +397295,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -394140,7 +397369,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -394267,12 +397496,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -394391,12 +397620,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -394741,7 +397972,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -394943,8 +398174,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -394952,19 +398183,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -394997,11 +398228,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -395009,11 +398245,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -395166,8 +398404,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -395240,7 +398478,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -395367,12 +398605,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -395491,12 +398729,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -395841,7 +399081,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -396043,8 +399283,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -396052,19 +399292,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -396097,11 +399337,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -396109,11 +399354,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -396266,8 +399513,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -396340,7 +399587,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -396467,12 +399714,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -396591,12 +399838,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -396941,7 +400190,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -397143,8 +400392,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -397152,19 +400401,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -397197,11 +400446,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -397209,11 +400463,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -397366,8 +400622,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -397440,7 +400696,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -397567,12 +400823,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -397691,12 +400947,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -398041,7 +401299,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -398243,8 +401501,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -398252,19 +401510,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -398297,11 +401555,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -398309,11 +401572,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -398466,8 +401731,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -398540,7 +401805,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -398667,12 +401932,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -398791,12 +402056,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -399141,7 +402408,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -399343,8 +402610,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -399352,19 +402619,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -399397,11 +402664,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -399409,11 +402681,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -399566,8 +402840,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -399640,7 +402914,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -399767,12 +403041,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -399891,12 +403165,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -400241,7 +403517,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -400443,8 +403719,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -400452,19 +403728,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -400497,11 +403773,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -400509,11 +403790,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -400666,8 +403949,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -400740,7 +404023,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -400867,12 +404150,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -400991,12 +404274,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -401341,7 +404626,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -401543,8 +404828,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -401552,19 +404837,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -401597,11 +404882,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -401609,11 +404899,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -401766,8 +405058,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -401840,7 +405132,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -401967,12 +405259,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -402091,12 +405383,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -402441,7 +405735,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
@@ -402643,8 +405937,8 @@ T1578.004,No,-,0
 T1148,No,-,0
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7
-T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7
+T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7
 T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7
 T1596.003,No,-,0
 T1056.001,No,-,0
@@ -402652,19 +405946,19 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,35
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,35
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,37
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,37
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -402697,11 +405991,16 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,5
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disabling_remote_user_account_control.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/eventvwr_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/fodhelper_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/net_profiler_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sdclt_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/silentcleanup_uac_bypass.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_runas_elevated.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/slui_spawning_a_process.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,10
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wsreset_uac_bypass.yml,10
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -402709,11 +406008,13 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,11
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_pst_export_alert.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,5
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_powershell.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excel_spawning_windows_script_host.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/extract_sam_from_registry.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_deleting_its_process_file_path.yml,7
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/sam_database_file_access_attempt.yml,7
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -402866,8 +406167,8 @@ T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/syste
 T1071,No,-,3
 T1074.002,No,-,0
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14
 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14
@@ -402940,7 +406241,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trick
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,29
+T1218,No,-,31
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -403067,12 +406368,12 @@ T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/attacker_tools_on_endpoint.yml,3
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,16
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,16
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -403191,12 +406492,14 @@ T1497,No,-,0
 T1102,No,-,0
 T1552.001,No,-,0
 T1568.003,No,-,0
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,6
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,6
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml,8
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml,8
 T1608,No,-,0
 T1608.005,No,-,0
 T1104,No,-,0
@@ -403541,7 +406844,7 @@ T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/commo
 T1485,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/high_file_deletion_frequency.yml,3
 T1132.002,No,-,0
 T1556.001,No,-,0
-T1537,No,-,0
+T1537,Yes,https://github.com/splunk/security_content/blob/develop/cloud/detect_shared_ec2_snapshot.yml,1
 T1130,No,-,0
 T1022,No,-,0
 T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,2
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index ce7a2dcd3e..7f7fb8821c 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -53,7 +53,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -63,7 +63,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -107,8 +107,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -123,8 +123,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -312,7 +312,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -568,7 +568,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -712,8 +712,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -1106,7 +1106,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -1361,7 +1365,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -1371,7 +1375,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -1415,8 +1419,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -1431,8 +1435,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -1620,7 +1624,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -1876,7 +1880,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -2020,8 +2024,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -2414,7 +2418,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -2669,7 +2677,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -2679,7 +2687,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -2723,8 +2731,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -2739,8 +2747,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -2928,7 +2936,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -3184,7 +3192,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -3328,8 +3336,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -3722,7 +3730,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -3977,7 +3989,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -3987,7 +3999,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -4031,8 +4043,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -4047,8 +4059,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -4236,7 +4248,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -4492,7 +4504,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -4636,8 +4648,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -5030,7 +5042,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -5285,7 +5301,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -5295,7 +5311,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -5339,8 +5355,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -5355,8 +5371,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -5544,7 +5560,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -5800,7 +5816,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -5944,8 +5960,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -6338,7 +6354,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -6593,7 +6613,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -6603,7 +6623,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -6647,8 +6667,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -6663,8 +6683,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -6852,7 +6872,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -7108,7 +7128,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -7252,8 +7272,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -7646,7 +7666,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -7901,7 +7925,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -7911,7 +7935,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -7955,8 +7979,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -7971,8 +7995,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -8160,7 +8184,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -8416,7 +8440,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -8560,8 +8584,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -8954,7 +8978,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -9209,7 +9237,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -9219,7 +9247,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -9263,8 +9291,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -9279,8 +9307,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -9468,7 +9496,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -9724,7 +9752,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -9868,8 +9896,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -10262,7 +10290,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -10517,7 +10549,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -10527,7 +10559,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -10571,8 +10603,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -10587,8 +10619,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -10776,7 +10808,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -11032,7 +11064,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -11176,8 +11208,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -11570,7 +11602,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -11825,7 +11861,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -11835,7 +11871,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -11879,8 +11915,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -11895,8 +11931,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -12084,7 +12120,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -12340,7 +12376,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -12484,8 +12520,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -12878,7 +12914,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -13133,7 +13173,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -13143,7 +13183,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -13187,8 +13227,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -13203,8 +13243,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -13392,7 +13432,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -13648,7 +13688,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -13792,8 +13832,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -14186,7 +14226,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -14441,7 +14485,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -14451,7 +14495,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -14495,8 +14539,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -14511,8 +14555,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -14700,7 +14744,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -14956,7 +15000,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -15100,8 +15144,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -15494,7 +15538,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -15749,7 +15797,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -15759,7 +15807,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -15803,8 +15851,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -15819,8 +15867,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -16008,7 +16056,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -16264,7 +16312,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -16408,8 +16456,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -16802,7 +16850,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -17057,7 +17109,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -17067,7 +17119,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -17111,8 +17163,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -17127,8 +17179,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -17316,7 +17368,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -17572,7 +17624,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -17716,8 +17768,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -18110,7 +18162,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -18365,7 +18421,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -18375,7 +18431,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -18419,8 +18475,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -18435,8 +18491,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -18624,7 +18680,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -18880,7 +18936,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -19024,8 +19080,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -19418,7 +19474,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -19673,7 +19733,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -19683,7 +19743,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -19727,8 +19787,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -19743,8 +19803,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -19932,7 +19992,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -20188,7 +20248,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -20332,8 +20392,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -20726,7 +20786,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -20981,7 +21045,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -20991,7 +21055,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -21035,8 +21099,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -21051,8 +21115,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -21240,7 +21304,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -21496,7 +21560,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -21640,8 +21704,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -22034,7 +22098,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -22289,7 +22357,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -22299,7 +22367,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -22343,8 +22411,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -22359,8 +22427,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -22548,7 +22616,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -22804,7 +22872,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -22948,8 +23016,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -23342,7 +23410,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -23597,7 +23669,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -23607,7 +23679,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -23651,8 +23723,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -23667,8 +23739,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -23856,7 +23928,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -24112,7 +24184,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -24256,8 +24328,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -24650,7 +24722,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -24905,7 +24981,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -24915,7 +24991,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -24959,8 +25035,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -24975,8 +25051,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -25164,7 +25240,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -25420,7 +25496,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -25564,8 +25640,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -25958,7 +26034,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -26213,7 +26293,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -26223,7 +26303,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -26267,8 +26347,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -26283,8 +26363,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -26472,7 +26552,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -26728,7 +26808,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -26872,8 +26952,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -27266,7 +27346,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -27521,7 +27605,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -27531,7 +27615,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -27575,8 +27659,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -27591,8 +27675,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -27780,7 +27864,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -28036,7 +28120,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -28180,8 +28264,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -28574,7 +28658,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -28829,7 +28917,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -28839,7 +28927,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -28883,8 +28971,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -28899,8 +28987,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -29088,7 +29176,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -29344,7 +29432,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -29488,8 +29576,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -29882,7 +29970,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -30137,7 +30229,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -30147,7 +30239,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -30191,8 +30283,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -30207,8 +30299,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -30396,7 +30488,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -30652,7 +30744,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -30796,8 +30888,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -31190,7 +31282,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -31445,7 +31541,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -31455,7 +31551,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -31499,8 +31595,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -31515,8 +31611,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -31704,7 +31800,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -31960,7 +32056,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -32104,8 +32200,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -32498,7 +32594,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -32753,7 +32853,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -32763,7 +32863,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -32807,8 +32907,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -32823,8 +32923,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -33012,7 +33112,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -33268,7 +33368,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -33412,8 +33512,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -33806,7 +33906,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -34061,7 +34165,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -34071,7 +34175,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -34115,8 +34219,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -34131,8 +34235,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -34320,7 +34424,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -34576,7 +34680,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -34720,8 +34824,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -35114,7 +35218,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -35369,7 +35477,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -35379,7 +35487,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -35423,8 +35531,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -35439,8 +35547,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -35628,7 +35736,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -35884,7 +35992,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -36028,8 +36136,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -36422,7 +36530,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -36677,7 +36789,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -36687,7 +36799,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -36731,8 +36843,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -36747,8 +36859,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -36936,7 +37048,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -37192,7 +37304,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -37336,8 +37448,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -37730,7 +37842,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -37985,7 +38101,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -37995,7 +38111,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -38039,8 +38155,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -38055,8 +38171,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -38244,7 +38360,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -38500,7 +38616,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -38644,8 +38760,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -39038,7 +39154,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -39293,7 +39413,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -39303,7 +39423,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -39347,8 +39467,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -39363,8 +39483,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -39552,7 +39672,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -39808,7 +39928,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -39952,8 +40072,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -40346,7 +40466,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -40601,7 +40725,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -40611,7 +40735,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -40655,8 +40779,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -40671,8 +40795,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -40860,7 +40984,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -41116,7 +41240,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -41260,8 +41384,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -41654,7 +41778,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -41909,7 +42037,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -41919,7 +42047,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -41963,8 +42091,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -41979,8 +42107,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -42168,7 +42296,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -42424,7 +42552,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -42568,8 +42696,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -42962,7 +43090,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -43217,7 +43349,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -43227,7 +43359,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -43271,8 +43403,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -43287,8 +43419,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -43476,7 +43608,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -43732,7 +43864,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -43876,8 +44008,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -44270,7 +44402,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -44525,7 +44661,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -44535,7 +44671,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -44579,8 +44715,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -44595,8 +44731,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -44784,7 +44920,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -45040,7 +45176,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -45184,8 +45320,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -45578,7 +45714,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -45833,7 +45973,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -45843,7 +45983,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -45887,8 +46027,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -45903,8 +46043,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -46092,7 +46232,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -46348,7 +46488,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -46492,8 +46632,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -46886,7 +47026,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -47141,7 +47285,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -47151,7 +47295,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -47195,8 +47339,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -47211,8 +47355,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -47400,7 +47544,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -47656,7 +47800,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -47800,8 +47944,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -48194,7 +48338,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -48449,7 +48597,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -48459,7 +48607,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -48503,8 +48651,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -48519,8 +48667,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -48708,7 +48856,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -48964,7 +49112,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -49108,8 +49256,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -49502,7 +49650,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -49757,7 +49909,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -49767,7 +49919,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -49811,8 +49963,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -49827,8 +49979,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -50016,7 +50168,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -50272,7 +50424,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -50416,8 +50568,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -50810,7 +50962,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -51065,7 +51221,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -51075,7 +51231,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -51119,8 +51275,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -51135,8 +51291,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -51324,7 +51480,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -51580,7 +51736,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -51724,8 +51880,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -52118,7 +52274,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -52373,7 +52533,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -52383,7 +52543,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -52427,8 +52587,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -52443,8 +52603,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -52632,7 +52792,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -52888,7 +53048,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -53032,8 +53192,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -53426,7 +53586,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -53681,7 +53845,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -53691,7 +53855,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -53735,8 +53899,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -53751,8 +53915,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -53940,7 +54104,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -54196,7 +54360,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -54340,8 +54504,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -54734,7 +54898,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -54989,7 +55157,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -54999,7 +55167,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -55043,8 +55211,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -55059,8 +55227,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -55248,7 +55416,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -55504,7 +55672,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -55648,8 +55816,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -56042,7 +56210,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -56297,7 +56469,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -56307,7 +56479,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -56351,8 +56523,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -56367,8 +56539,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -56556,7 +56728,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -56812,7 +56984,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -56956,8 +57128,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -57350,7 +57522,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -57605,7 +57781,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -57615,7 +57791,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -57659,8 +57835,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -57675,8 +57851,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -57864,7 +58040,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -58120,7 +58296,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -58264,8 +58440,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -58658,7 +58834,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -58913,7 +59093,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -58923,7 +59103,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -58967,8 +59147,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -58983,8 +59163,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -59172,7 +59352,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -59428,7 +59608,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -59572,8 +59752,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -59966,7 +60146,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -60221,7 +60405,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -60231,7 +60415,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -60275,8 +60459,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -60291,8 +60475,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -60480,7 +60664,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -60736,7 +60920,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -60880,8 +61064,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -61274,7 +61458,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -61529,7 +61717,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -61539,7 +61727,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -61583,8 +61771,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -61599,8 +61787,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -61788,7 +61976,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -62044,7 +62232,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -62188,8 +62376,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -62582,7 +62770,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -62837,7 +63029,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -62847,7 +63039,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -62891,8 +63083,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -62907,8 +63099,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -63096,7 +63288,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -63352,7 +63544,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -63496,8 +63688,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -63890,7 +64082,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -64145,7 +64341,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -64155,7 +64351,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -64199,8 +64395,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -64215,8 +64411,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -64404,7 +64600,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -64660,7 +64856,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -64804,8 +65000,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -65198,7 +65394,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -65453,7 +65653,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -65463,7 +65663,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -65507,8 +65707,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -65523,8 +65723,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -65712,7 +65912,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -65968,7 +66168,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -66112,8 +66312,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -66506,7 +66706,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -66761,7 +66965,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -66771,7 +66975,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -66815,8 +67019,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -66831,8 +67035,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -67020,7 +67224,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -67276,7 +67480,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -67420,8 +67624,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -67814,7 +68018,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -68069,7 +68277,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -68079,7 +68287,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -68123,8 +68331,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -68139,8 +68347,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -68328,7 +68536,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -68584,7 +68792,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -68728,8 +68936,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -69122,7 +69330,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -69377,7 +69589,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -69387,7 +69599,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -69431,8 +69643,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -69447,8 +69659,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -69636,7 +69848,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -69892,7 +70104,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -70036,8 +70248,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -70430,7 +70642,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -70685,7 +70901,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -70695,7 +70911,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -70739,8 +70955,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -70755,8 +70971,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -70944,7 +71160,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -71200,7 +71416,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -71344,8 +71560,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -71738,7 +71954,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -71993,7 +72213,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -72003,7 +72223,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -72047,8 +72267,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -72063,8 +72283,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -72252,7 +72472,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -72508,7 +72728,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -72652,8 +72872,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -73046,7 +73266,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -73301,7 +73525,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -73311,7 +73535,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -73355,8 +73579,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -73371,8 +73595,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -73560,7 +73784,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -73816,7 +74040,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -73960,8 +74184,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -74354,7 +74578,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -74609,7 +74837,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -74619,7 +74847,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -74663,8 +74891,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -74679,8 +74907,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -74868,7 +75096,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -75124,7 +75352,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -75268,8 +75496,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -75662,7 +75890,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -75917,7 +76149,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -75927,7 +76159,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -75971,8 +76203,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -75987,8 +76219,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -76176,7 +76408,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -76432,7 +76664,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -76576,8 +76808,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -76970,7 +77202,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -77225,7 +77461,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -77235,7 +77471,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -77279,8 +77515,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -77295,8 +77531,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -77484,7 +77720,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -77740,7 +77976,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -77884,8 +78120,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -78278,7 +78514,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -78533,7 +78773,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -78543,7 +78783,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -78587,8 +78827,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -78603,8 +78843,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -78792,7 +79032,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -79048,7 +79288,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -79192,8 +79432,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -79586,7 +79826,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -79841,7 +80085,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -79851,7 +80095,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -79895,8 +80139,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -79911,8 +80155,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -80100,7 +80344,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -80356,7 +80600,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -80500,8 +80744,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -80894,7 +81138,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -81149,7 +81397,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -81159,7 +81407,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -81203,8 +81451,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -81219,8 +81467,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -81408,7 +81656,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -81664,7 +81912,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -81808,8 +82056,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -82202,7 +82450,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -82457,7 +82709,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -82467,7 +82719,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -82511,8 +82763,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -82527,8 +82779,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -82716,7 +82968,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -82972,7 +83224,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -83116,8 +83368,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -83510,7 +83762,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -83765,7 +84021,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -83775,7 +84031,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -83819,8 +84075,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -83835,8 +84091,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -84024,7 +84280,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -84280,7 +84536,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -84424,8 +84680,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -84818,7 +85074,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -85073,7 +85333,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -85083,7 +85343,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -85127,8 +85387,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -85143,8 +85403,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -85332,7 +85592,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -85588,7 +85848,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -85732,8 +85992,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -86126,7 +86386,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -86381,7 +86645,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -86391,7 +86655,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -86435,8 +86699,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -86451,8 +86715,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -86640,7 +86904,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -86896,7 +87160,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -87040,8 +87304,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -87434,7 +87698,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -87689,7 +87957,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -87699,7 +87967,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -87743,8 +88011,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -87759,8 +88027,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -87948,7 +88216,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -88204,7 +88472,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -88348,8 +88616,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -88742,7 +89010,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -88997,7 +89269,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -89007,7 +89279,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -89051,8 +89323,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -89067,8 +89339,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -89256,7 +89528,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -89512,7 +89784,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -89656,8 +89928,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -90050,7 +90322,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -90305,7 +90581,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -90315,7 +90591,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -90359,8 +90635,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -90375,8 +90651,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -90564,7 +90840,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -90820,7 +91096,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -90964,8 +91240,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -91358,7 +91634,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -91613,7 +91893,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -91623,7 +91903,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -91667,8 +91947,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -91683,8 +91963,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -91872,7 +92152,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -92128,7 +92408,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -92272,8 +92552,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -92666,7 +92946,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -92921,7 +93205,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -92931,7 +93215,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -92975,8 +93259,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -92991,8 +93275,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -93180,7 +93464,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -93436,7 +93720,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -93580,8 +93864,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -93974,7 +94258,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -94229,7 +94517,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -94239,7 +94527,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -94283,8 +94571,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -94299,8 +94587,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -94488,7 +94776,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -94744,7 +95032,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -94888,8 +95176,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -95282,7 +95570,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -95537,7 +95829,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -95547,7 +95839,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -95591,8 +95883,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -95607,8 +95899,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -95796,7 +96088,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -96052,7 +96344,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -96196,8 +96488,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -96590,7 +96882,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -96845,7 +97141,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -96855,7 +97151,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -96899,8 +97195,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -96915,8 +97211,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -97104,7 +97400,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -97360,7 +97656,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -97504,8 +97800,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -97898,7 +98194,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -98153,7 +98453,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -98163,7 +98463,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -98207,8 +98507,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -98223,8 +98523,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -98412,7 +98712,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -98668,7 +98968,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -98812,8 +99112,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -99206,7 +99506,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -99461,7 +99765,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -99471,7 +99775,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -99515,8 +99819,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -99531,8 +99835,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -99720,7 +100024,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -99976,7 +100280,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -100120,8 +100424,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -100514,7 +100818,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -100769,7 +101077,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -100779,7 +101087,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -100823,8 +101131,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -100839,8 +101147,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -101028,7 +101336,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -101284,7 +101592,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -101428,8 +101736,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -101822,7 +102130,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -102077,7 +102389,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -102087,7 +102399,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -102131,8 +102443,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -102147,8 +102459,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -102336,7 +102648,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -102592,7 +102904,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -102736,8 +103048,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -103130,7 +103442,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -103385,7 +103701,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -103395,7 +103711,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -103439,8 +103755,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -103455,8 +103771,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -103644,7 +103960,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -103900,7 +104216,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -104044,8 +104360,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -104438,7 +104754,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -104693,7 +105013,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -104703,7 +105023,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -104747,8 +105067,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -104763,8 +105083,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -104952,7 +105272,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -105208,7 +105528,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -105352,8 +105672,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -105746,7 +106066,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -106001,7 +106325,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -106011,7 +106335,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -106055,8 +106379,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -106071,8 +106395,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -106260,7 +106584,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -106516,7 +106840,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -106660,8 +106984,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -107054,7 +107378,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -107309,7 +107637,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -107319,7 +107647,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -107363,8 +107691,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -107379,8 +107707,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -107568,7 +107896,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -107824,7 +108152,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -107968,8 +108296,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -108362,7 +108690,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -108617,7 +108949,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -108627,7 +108959,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -108671,8 +109003,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -108687,8 +109019,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -108876,7 +109208,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -109132,7 +109464,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -109276,8 +109608,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -109670,7 +110002,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -109925,7 +110261,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -109935,7 +110271,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -109979,8 +110315,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -109995,8 +110331,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -110184,7 +110520,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -110440,7 +110776,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -110584,8 +110920,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -110978,7 +111314,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -111233,7 +111573,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -111243,7 +111583,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -111287,8 +111627,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -111303,8 +111643,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -111492,7 +111832,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -111748,7 +112088,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -111892,8 +112232,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -112286,7 +112626,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -112541,7 +112885,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -112551,7 +112895,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -112595,8 +112939,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -112611,8 +112955,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -112800,7 +113144,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -113056,7 +113400,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -113200,8 +113544,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -113594,7 +113938,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -113849,7 +114197,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -113859,7 +114207,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -113903,8 +114251,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -113919,8 +114267,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -114108,7 +114456,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -114364,7 +114712,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -114508,8 +114856,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -114902,7 +115250,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -115157,7 +115509,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -115167,7 +115519,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -115211,8 +115563,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -115227,8 +115579,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -115416,7 +115768,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -115672,7 +116024,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -115816,8 +116168,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -116210,7 +116562,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -116465,7 +116821,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -116475,7 +116831,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -116519,8 +116875,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -116535,8 +116891,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -116724,7 +117080,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -116980,7 +117336,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -117124,8 +117480,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -117518,7 +117874,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -117773,7 +118133,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -117783,7 +118143,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -117827,8 +118187,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -117843,8 +118203,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -118032,7 +118392,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -118288,7 +118648,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -118432,8 +118792,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -118826,7 +119186,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -119081,7 +119445,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -119091,7 +119455,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -119135,8 +119499,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -119151,8 +119515,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -119340,7 +119704,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -119596,7 +119960,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -119740,8 +120104,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -120134,7 +120498,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -120389,7 +120757,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -120399,7 +120767,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -120443,8 +120811,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -120459,8 +120827,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -120648,7 +121016,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -120904,7 +121272,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -121048,8 +121416,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -121442,7 +121810,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -121697,7 +122069,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -121707,7 +122079,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -121751,8 +122123,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -121767,8 +122139,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -121956,7 +122328,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -122212,7 +122584,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -122356,8 +122728,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -122750,7 +123122,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -123005,7 +123381,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -123015,7 +123391,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -123059,8 +123435,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -123075,8 +123451,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -123264,7 +123640,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -123520,7 +123896,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -123664,8 +124040,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -124058,7 +124434,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -124313,7 +124693,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -124323,7 +124703,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -124367,8 +124747,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -124383,8 +124763,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -124572,7 +124952,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -124828,7 +125208,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -124972,8 +125352,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -125366,7 +125746,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -125621,7 +126005,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -125631,7 +126015,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -125675,8 +126059,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -125691,8 +126075,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -125880,7 +126264,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -126136,7 +126520,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -126280,8 +126664,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -126674,7 +127058,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -126929,7 +127317,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -126939,7 +127327,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -126983,8 +127371,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -126999,8 +127387,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -127188,7 +127576,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -127444,7 +127832,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -127588,8 +127976,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -127982,7 +128370,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -128237,7 +128629,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -128247,7 +128639,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -128291,8 +128683,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -128307,8 +128699,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -128496,7 +128888,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -128752,7 +129144,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -128896,8 +129288,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -129290,7 +129682,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -129545,7 +129941,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -129555,7 +129951,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -129599,8 +129995,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -129615,8 +130011,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -129804,7 +130200,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -130060,7 +130456,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -130204,8 +130600,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -130598,7 +130994,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -130853,7 +131253,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -130863,7 +131263,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -130907,8 +131307,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -130923,8 +131323,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -131112,7 +131512,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -131368,7 +131768,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -131512,8 +131912,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -131906,7 +132306,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -132161,7 +132565,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -132171,7 +132575,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -132215,8 +132619,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -132231,8 +132635,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -132420,7 +132824,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -132676,7 +133080,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -132820,8 +133224,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -133214,7 +133618,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -133469,7 +133877,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -133479,7 +133887,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -133523,8 +133931,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -133539,8 +133947,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -133728,7 +134136,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -133984,7 +134392,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -134128,8 +134536,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -134522,7 +134930,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -134777,7 +135189,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -134787,7 +135199,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -134831,8 +135243,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -134847,8 +135259,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -135036,7 +135448,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -135292,7 +135704,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -135436,8 +135848,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -135830,7 +136242,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -136085,7 +136501,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -136095,7 +136511,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -136139,8 +136555,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -136155,8 +136571,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -136344,7 +136760,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -136600,7 +137016,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -136744,8 +137160,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -137138,7 +137554,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -137393,7 +137813,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -137403,7 +137823,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -137447,8 +137867,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -137463,8 +137883,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -137652,7 +138072,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -137908,7 +138328,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -138052,8 +138472,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -138446,7 +138866,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -138701,7 +139125,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -138711,7 +139135,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -138755,8 +139179,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -138771,8 +139195,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -138960,7 +139384,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -139216,7 +139640,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -139360,8 +139784,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -139754,7 +140178,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -140009,7 +140437,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -140019,7 +140447,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -140063,8 +140491,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -140079,8 +140507,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -140268,7 +140696,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -140524,7 +140952,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -140668,8 +141096,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -141062,7 +141490,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -141317,7 +141749,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -141327,7 +141759,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -141371,8 +141803,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -141387,8 +141819,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -141576,7 +142008,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -141832,7 +142264,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -141976,8 +142408,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -142370,7 +142802,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -142625,7 +143061,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -142635,7 +143071,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -142679,8 +143115,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -142695,8 +143131,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -142884,7 +143320,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -143140,7 +143576,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -143284,8 +143720,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -143678,7 +144114,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -143933,7 +144373,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -143943,7 +144383,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -143987,8 +144427,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -144003,8 +144443,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -144192,7 +144632,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -144448,7 +144888,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -144592,8 +145032,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -144986,7 +145426,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -145241,7 +145685,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -145251,7 +145695,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -145295,8 +145739,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -145311,8 +145755,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -145500,7 +145944,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -145756,7 +146200,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -145900,8 +146344,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -146294,7 +146738,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -146549,7 +146997,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -146559,7 +147007,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -146603,8 +147051,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -146619,8 +147067,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -146808,7 +147256,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -147064,7 +147512,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -147208,8 +147656,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -147602,7 +148050,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -147857,7 +148309,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -147867,7 +148319,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -147911,8 +148363,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -147927,8 +148379,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -148116,7 +148568,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -148372,7 +148824,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -148516,8 +148968,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -148910,7 +149362,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -149165,7 +149621,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -149175,7 +149631,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -149219,8 +149675,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -149235,8 +149691,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -149424,7 +149880,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -149680,7 +150136,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -149824,8 +150280,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -150218,7 +150674,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -150473,7 +150933,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -150483,7 +150943,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -150527,8 +150987,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -150543,8 +151003,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -150732,7 +151192,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -150988,7 +151448,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -151132,8 +151592,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -151526,7 +151986,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -151781,7 +152245,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -151791,7 +152255,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -151835,8 +152299,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -151851,8 +152315,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -152040,7 +152504,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -152296,7 +152760,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -152440,8 +152904,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -152834,7 +153298,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -153089,7 +153557,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -153099,7 +153567,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -153143,8 +153611,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -153159,8 +153627,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -153348,7 +153816,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -153604,7 +154072,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -153748,8 +154216,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -154142,7 +154610,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -154397,7 +154869,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -154407,7 +154879,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -154451,8 +154923,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -154467,8 +154939,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -154656,7 +155128,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -154912,7 +155384,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -155056,8 +155528,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -155450,7 +155922,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -155705,7 +156181,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -155715,7 +156191,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -155759,8 +156235,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -155775,8 +156251,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -155964,7 +156440,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -156220,7 +156696,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -156364,8 +156840,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -156758,7 +157234,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -157013,7 +157493,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -157023,7 +157503,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -157067,8 +157547,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -157083,8 +157563,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -157272,7 +157752,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -157528,7 +158008,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -157672,8 +158152,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -158066,7 +158546,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -158321,7 +158805,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -158331,7 +158815,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -158375,8 +158859,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -158391,8 +158875,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -158580,7 +159064,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -158836,7 +159320,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -158980,8 +159464,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -159374,7 +159858,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -159629,7 +160117,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -159639,7 +160127,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -159683,8 +160171,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -159699,8 +160187,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -159888,7 +160376,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -160144,7 +160632,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -160288,8 +160776,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -160682,7 +161170,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -160937,7 +161429,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -160947,7 +161439,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -160991,8 +161483,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -161007,8 +161499,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -161196,7 +161688,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -161452,7 +161944,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -161596,8 +162088,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -161990,7 +162482,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -162245,7 +162741,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -162255,7 +162751,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -162299,8 +162795,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -162315,8 +162811,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -162504,7 +163000,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -162760,7 +163256,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -162904,8 +163400,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -163298,7 +163794,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -163553,7 +164053,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -163563,7 +164063,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -163607,8 +164107,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -163623,8 +164123,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -163812,7 +164312,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -164068,7 +164568,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -164212,8 +164712,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -164606,7 +165106,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -164861,7 +165365,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -164871,7 +165375,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -164915,8 +165419,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -164931,8 +165435,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -165120,7 +165624,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -165376,7 +165880,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -165520,8 +166024,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -165914,7 +166418,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -166169,7 +166677,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -166179,7 +166687,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -166223,8 +166731,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -166239,8 +166747,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -166428,7 +166936,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -166684,7 +167192,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -166828,8 +167336,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -167222,7 +167730,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -167477,7 +167989,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -167487,7 +167999,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -167531,8 +168043,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -167547,8 +168059,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -167736,7 +168248,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -167992,7 +168504,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -168136,8 +168648,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -168530,7 +169042,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -168785,7 +169301,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -168795,7 +169311,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -168839,8 +169355,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -168855,8 +169371,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -169044,7 +169560,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -169300,7 +169816,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -169444,8 +169960,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -169838,7 +170354,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -170093,7 +170613,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -170103,7 +170623,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -170147,8 +170667,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -170163,8 +170683,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -170352,7 +170872,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -170608,7 +171128,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -170752,8 +171272,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -171146,7 +171666,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -171401,7 +171925,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -171411,7 +171935,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -171455,8 +171979,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -171471,8 +171995,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -171660,7 +172184,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -171916,7 +172440,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -172060,8 +172584,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -172454,7 +172978,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -172709,7 +173237,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -172719,7 +173247,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -172763,8 +173291,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -172779,8 +173307,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -172968,7 +173496,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -173224,7 +173752,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -173368,8 +173896,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -173762,7 +174290,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -174017,7 +174549,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -174027,7 +174559,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -174071,8 +174603,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -174087,8 +174619,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -174276,7 +174808,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -174532,7 +175064,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -174676,8 +175208,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -175070,7 +175602,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -175325,7 +175861,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -175335,7 +175871,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -175379,8 +175915,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -175395,8 +175931,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -175584,7 +176120,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -175840,7 +176376,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -175984,8 +176520,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -176378,7 +176914,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -176633,7 +177173,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -176643,7 +177183,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -176687,8 +177227,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -176703,8 +177243,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -176892,7 +177432,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -177148,7 +177688,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -177292,8 +177832,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -177686,7 +178226,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -177941,7 +178485,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -177951,7 +178495,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -177995,8 +178539,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -178011,8 +178555,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -178200,7 +178744,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -178456,7 +179000,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -178600,8 +179144,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -178994,7 +179538,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -179249,7 +179797,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -179259,7 +179807,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -179303,8 +179851,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -179319,8 +179867,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -179508,7 +180056,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -179764,7 +180312,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -179908,8 +180456,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -180302,7 +180850,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -180557,7 +181109,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -180567,7 +181119,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -180611,8 +181163,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -180627,8 +181179,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -180816,7 +181368,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -181072,7 +181624,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -181216,8 +181768,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -181610,7 +182162,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -181865,7 +182421,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -181875,7 +182431,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -181919,8 +182475,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -181935,8 +182491,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -182124,7 +182680,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -182380,7 +182936,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -182524,8 +183080,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -182918,7 +183474,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -183173,7 +183733,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -183183,7 +183743,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -183227,8 +183787,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -183243,8 +183803,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -183432,7 +183992,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -183688,7 +184248,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -183832,8 +184392,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -184226,7 +184786,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -184481,7 +185045,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -184491,7 +185055,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -184535,8 +185099,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -184551,8 +185115,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -184740,7 +185304,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -184996,7 +185560,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -185140,8 +185704,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -185534,7 +186098,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -185789,7 +186357,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -185799,7 +186367,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -185843,8 +186411,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -185859,8 +186427,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -186048,7 +186616,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -186304,7 +186872,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -186448,8 +187016,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -186842,7 +187410,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -187097,7 +187669,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -187107,7 +187679,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -187151,8 +187723,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -187167,8 +187739,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -187356,7 +187928,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -187612,7 +188184,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -187756,8 +188328,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -188150,7 +188722,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -188405,7 +188981,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -188415,7 +188991,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -188459,8 +189035,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -188475,8 +189051,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -188664,7 +189240,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -188920,7 +189496,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -189064,8 +189640,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -189458,7 +190034,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -189713,7 +190293,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -189723,7 +190303,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -189767,8 +190347,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -189783,8 +190363,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -189972,7 +190552,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -190228,7 +190808,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -190372,8 +190952,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -190766,7 +191346,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -191021,7 +191605,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -191031,7 +191615,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -191075,8 +191659,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -191091,8 +191675,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -191280,7 +191864,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -191536,7 +192120,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -191680,8 +192264,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -192074,7 +192658,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -192329,7 +192917,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -192339,7 +192927,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -192383,8 +192971,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -192399,8 +192987,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -192588,7 +193176,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -192844,7 +193432,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -192988,8 +193576,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -193382,7 +193970,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -193637,7 +194229,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -193647,7 +194239,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -193691,8 +194283,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -193707,8 +194299,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -193896,7 +194488,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -194152,7 +194744,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -194296,8 +194888,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -194690,7 +195282,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -194945,7 +195541,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -194955,7 +195551,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -194999,8 +195595,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -195015,8 +195611,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -195204,7 +195800,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -195460,7 +196056,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -195604,8 +196200,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -195998,7 +196594,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -196253,7 +196853,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -196263,7 +196863,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -196307,8 +196907,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -196323,8 +196923,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -196512,7 +197112,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -196768,7 +197368,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -196912,8 +197512,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -197306,7 +197906,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -197561,7 +198165,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -197571,7 +198175,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -197615,8 +198219,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -197631,8 +198235,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -197820,7 +198424,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -198076,7 +198680,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -198220,8 +198824,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -198614,7 +199218,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -198869,7 +199477,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -198879,7 +199487,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -198923,8 +199531,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -198939,8 +199547,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -199128,7 +199736,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -199384,7 +199992,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -199528,8 +200136,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -199922,7 +200530,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -200177,7 +200789,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -200187,7 +200799,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -200231,8 +200843,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -200247,8 +200859,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -200436,7 +201048,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -200692,7 +201304,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -200836,8 +201448,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -201230,7 +201842,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -201485,7 +202101,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -201495,7 +202111,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -201539,8 +202155,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -201555,8 +202171,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -201744,7 +202360,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -202000,7 +202616,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -202144,8 +202760,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -202538,7 +203154,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -202793,7 +203413,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -202803,7 +203423,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -202847,8 +203467,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -202863,8 +203483,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -203052,7 +203672,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -203308,7 +203928,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -203452,8 +204072,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -203846,7 +204466,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -204101,7 +204725,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -204111,7 +204735,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -204155,8 +204779,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -204171,8 +204795,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -204360,7 +204984,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -204616,7 +205240,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -204760,8 +205384,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -205154,7 +205778,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -205409,7 +206037,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -205419,7 +206047,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -205463,8 +206091,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -205479,8 +206107,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -205668,7 +206296,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -205924,7 +206552,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -206068,8 +206696,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -206462,7 +207090,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -206717,7 +207349,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -206727,7 +207359,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -206771,8 +207403,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -206787,8 +207419,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -206976,7 +207608,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -207232,7 +207864,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -207376,8 +208008,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -207770,7 +208402,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -208025,7 +208661,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -208035,7 +208671,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -208079,8 +208715,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -208095,8 +208731,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -208284,7 +208920,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -208540,7 +209176,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -208684,8 +209320,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -209078,7 +209714,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -209333,7 +209973,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -209343,7 +209983,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -209387,8 +210027,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -209403,8 +210043,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -209592,7 +210232,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -209848,7 +210488,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -209992,8 +210632,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -210386,7 +211026,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -210641,7 +211285,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -210651,7 +211295,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -210695,8 +211339,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -210711,8 +211355,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -210900,7 +211544,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -211156,7 +211800,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -211300,8 +211944,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -211694,7 +212338,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -211949,7 +212597,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -211959,7 +212607,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -212003,8 +212651,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -212019,8 +212667,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -212208,7 +212856,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -212464,7 +213112,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -212608,8 +213256,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -213002,7 +213650,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -213257,7 +213909,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -213267,7 +213919,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -213311,8 +213963,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -213327,8 +213979,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -213516,7 +214168,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -213772,7 +214424,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -213916,8 +214568,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -214310,7 +214962,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -214565,7 +215221,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -214575,7 +215231,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -214619,8 +215275,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -214635,8 +215291,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -214824,7 +215480,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -215080,7 +215736,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -215224,8 +215880,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -215618,7 +216274,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -215873,7 +216533,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -215883,7 +216543,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -215927,8 +216587,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -215943,8 +216603,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -216132,7 +216792,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -216388,7 +217048,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -216532,8 +217192,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -216926,7 +217586,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -217181,7 +217845,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -217191,7 +217855,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -217235,8 +217899,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -217251,8 +217915,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -217440,7 +218104,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -217696,7 +218360,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -217840,8 +218504,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -218234,7 +218898,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -218489,7 +219157,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -218499,7 +219167,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -218543,8 +219211,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -218559,8 +219227,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -218748,7 +219416,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -219004,7 +219672,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -219148,8 +219816,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -219542,7 +220210,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -219797,7 +220469,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -219807,7 +220479,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -219851,8 +220523,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -219867,8 +220539,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -220056,7 +220728,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -220312,7 +220984,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -220456,8 +221128,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -220850,7 +221522,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -221105,7 +221781,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -221115,7 +221791,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -221159,8 +221835,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -221175,8 +221851,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -221364,7 +222040,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -221620,7 +222296,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -221764,8 +222440,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -222158,7 +222834,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -222413,7 +223093,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -222423,7 +223103,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -222467,8 +223147,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -222483,8 +223163,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -222672,7 +223352,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -222928,7 +223608,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -223072,8 +223752,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -223466,7 +224146,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -223721,7 +224405,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -223731,7 +224415,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -223775,8 +224459,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -223791,8 +224475,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -223980,7 +224664,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -224236,7 +224920,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -224380,8 +225064,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -224774,7 +225458,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -225029,7 +225717,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -225039,7 +225727,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -225083,8 +225771,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -225099,8 +225787,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -225288,7 +225976,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -225544,7 +226232,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -225688,8 +226376,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -226082,7 +226770,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -226337,7 +227029,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -226347,7 +227039,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -226391,8 +227083,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -226407,8 +227099,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -226596,7 +227288,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -226852,7 +227544,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -226996,8 +227688,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -227390,7 +228082,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -227645,7 +228341,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -227655,7 +228351,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -227699,8 +228395,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -227715,8 +228411,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -227904,7 +228600,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -228160,7 +228856,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -228304,8 +229000,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -228698,7 +229394,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -228953,7 +229653,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -228963,7 +229663,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -229007,8 +229707,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -229023,8 +229723,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -229212,7 +229912,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -229468,7 +230168,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -229612,8 +230312,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -230006,7 +230706,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -230261,7 +230965,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -230271,7 +230975,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -230315,8 +231019,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -230331,8 +231035,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -230520,7 +231224,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -230776,7 +231480,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -230920,8 +231624,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -231314,7 +232018,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -231569,7 +232277,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -231579,7 +232287,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -231623,8 +232331,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -231639,8 +232347,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -231828,7 +232536,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -232084,7 +232792,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -232228,8 +232936,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -232622,7 +233330,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -232877,7 +233589,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -232887,7 +233599,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -232931,8 +233643,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -232947,8 +233659,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -233136,7 +233848,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -233392,7 +234104,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -233536,8 +234248,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -233930,7 +234642,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -234185,7 +234901,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -234195,7 +234911,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -234239,8 +234955,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -234255,8 +234971,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -234444,7 +235160,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -234700,7 +235416,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -234844,8 +235560,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -235238,7 +235954,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -235493,7 +236213,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -235503,7 +236223,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -235547,8 +236267,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -235563,8 +236283,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -235752,7 +236472,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -236008,7 +236728,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -236152,8 +236872,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -236546,7 +237266,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -236801,7 +237525,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -236811,7 +237535,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -236855,8 +237579,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -236871,8 +237595,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -237060,7 +237784,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -237316,7 +238040,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -237460,8 +238184,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -237854,7 +238578,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -238109,7 +238837,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -238119,7 +238847,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -238163,8 +238891,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -238179,8 +238907,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -238368,7 +239096,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -238624,7 +239352,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -238768,8 +239496,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -239162,7 +239890,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -239417,7 +240149,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -239427,7 +240159,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -239471,8 +240203,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -239487,8 +240219,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -239676,7 +240408,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -239932,7 +240664,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -240076,8 +240808,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -240470,7 +241202,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -240725,7 +241461,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -240735,7 +241471,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -240779,8 +241515,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -240795,8 +241531,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -240984,7 +241720,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -241240,7 +241976,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -241384,8 +242120,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -241778,7 +242514,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -242033,7 +242773,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -242043,7 +242783,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -242087,8 +242827,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -242103,8 +242843,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -242292,7 +243032,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -242548,7 +243288,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -242692,8 +243432,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -243086,7 +243826,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -243341,7 +244085,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -243351,7 +244095,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -243395,8 +244139,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -243411,8 +244155,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -243600,7 +244344,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -243856,7 +244600,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -244000,8 +244744,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -244394,7 +245138,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -244649,7 +245397,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -244659,7 +245407,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -244703,8 +245451,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -244719,8 +245467,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -244908,7 +245656,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -245164,7 +245912,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -245308,8 +246056,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -245702,7 +246450,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -245957,7 +246709,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -245967,7 +246719,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -246011,8 +246763,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -246027,8 +246779,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -246216,7 +246968,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -246472,7 +247224,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -246616,8 +247368,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -247010,7 +247762,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -247265,7 +248021,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -247275,7 +248031,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -247319,8 +248075,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -247335,8 +248091,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -247524,7 +248280,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -247780,7 +248536,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -247924,8 +248680,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -248318,7 +249074,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -248573,7 +249333,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -248583,7 +249343,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -248627,8 +249387,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -248643,8 +249403,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -248832,7 +249592,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -249088,7 +249848,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -249232,8 +249992,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -249626,7 +250386,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -249881,7 +250645,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -249891,7 +250655,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -249935,8 +250699,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -249951,8 +250715,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -250140,7 +250904,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -250396,7 +251160,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -250540,8 +251304,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -250934,7 +251698,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -251189,7 +251957,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -251199,7 +251967,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -251243,8 +252011,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -251259,8 +252027,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -251448,7 +252216,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -251704,7 +252472,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -251848,8 +252616,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -252242,7 +253010,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -252497,7 +253269,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -252507,7 +253279,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -252551,8 +253323,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -252567,8 +253339,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -252756,7 +253528,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -253012,7 +253784,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -253156,8 +253928,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -253550,7 +254322,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -253805,7 +254581,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -253815,7 +254591,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -253859,8 +254635,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -253875,8 +254651,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -254064,7 +254840,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -254320,7 +255096,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -254464,8 +255240,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -254858,7 +255634,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -255113,7 +255893,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -255123,7 +255903,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -255167,8 +255947,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -255183,8 +255963,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -255372,7 +256152,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -255628,7 +256408,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -255772,8 +256552,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -256166,7 +256946,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -256421,7 +257205,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -256431,7 +257215,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -256475,8 +257259,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -256491,8 +257275,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -256680,7 +257464,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -256936,7 +257720,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -257080,8 +257864,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -257474,7 +258258,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -257729,7 +258517,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -257739,7 +258527,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -257783,8 +258571,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -257799,8 +258587,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -257988,7 +258776,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -258244,7 +259032,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -258388,8 +259176,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -258782,7 +259570,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -259037,7 +259829,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -259047,7 +259839,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -259091,8 +259883,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -259107,8 +259899,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -259296,7 +260088,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -259552,7 +260344,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -259696,8 +260488,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -260090,7 +260882,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -260345,7 +261141,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -260355,7 +261151,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -260399,8 +261195,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -260415,8 +261211,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -260604,7 +261400,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -260860,7 +261656,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -261004,8 +261800,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -261398,7 +262194,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -261653,7 +262453,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -261663,7 +262463,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -261707,8 +262507,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -261723,8 +262523,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -261912,7 +262712,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -262168,7 +262968,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -262312,8 +263112,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -262706,7 +263506,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -262961,7 +263765,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -262971,7 +263775,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -263015,8 +263819,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -263031,8 +263835,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -263220,7 +264024,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -263476,7 +264280,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -263620,8 +264424,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -264014,7 +264818,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -264269,7 +265077,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -264279,7 +265087,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -264323,8 +265131,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -264339,8 +265147,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -264528,7 +265336,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -264784,7 +265592,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -264928,8 +265736,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -265322,7 +266130,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -265577,7 +266389,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -265587,7 +266399,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -265631,8 +266443,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -265647,8 +266459,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -265836,7 +266648,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -266092,7 +266904,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -266236,8 +267048,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -266630,7 +267442,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -266885,7 +267701,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -266895,7 +267711,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -266939,8 +267755,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -266955,8 +267771,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -267144,7 +267960,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -267400,7 +268216,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -267544,8 +268360,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -267938,7 +268754,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -268193,7 +269013,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -268203,7 +269023,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -268247,8 +269067,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -268263,8 +269083,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -268452,7 +269272,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -268708,7 +269528,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -268852,8 +269672,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -269246,7 +270066,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -269501,7 +270325,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -269511,7 +270335,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -269555,8 +270379,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -269571,8 +270395,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -269760,7 +270584,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -270016,7 +270840,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -270160,8 +270984,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -270554,7 +271378,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -270809,7 +271637,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -270819,7 +271647,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -270863,8 +271691,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -270879,8 +271707,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -271068,7 +271896,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -271324,7 +272152,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -271468,8 +272296,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -271862,7 +272690,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -272117,7 +272949,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -272127,7 +272959,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -272171,8 +273003,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -272187,8 +273019,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -272376,7 +273208,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -272632,7 +273464,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -272776,8 +273608,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -273170,7 +274002,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -273425,7 +274261,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -273435,7 +274271,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -273479,8 +274315,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -273495,8 +274331,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -273684,7 +274520,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -273940,7 +274776,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -274084,8 +274920,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -274478,7 +275314,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -274733,7 +275573,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -274743,7 +275583,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -274787,8 +275627,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -274803,8 +275643,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -274992,7 +275832,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -275248,7 +276088,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -275392,8 +276232,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -275786,7 +276626,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -276041,7 +276885,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -276051,7 +276895,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -276095,8 +276939,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -276111,8 +276955,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -276300,7 +277144,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -276556,7 +277400,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -276700,8 +277544,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -277094,7 +277938,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -277349,7 +278197,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -277359,7 +278207,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -277403,8 +278251,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -277419,8 +278267,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -277608,7 +278456,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -277864,7 +278712,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -278008,8 +278856,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -278402,7 +279250,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -278657,7 +279509,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -278667,7 +279519,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -278711,8 +279563,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -278727,8 +279579,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -278916,7 +279768,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -279172,7 +280024,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -279316,8 +280168,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -279710,7 +280562,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -279965,7 +280821,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -279975,7 +280831,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -280019,8 +280875,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -280035,8 +280891,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -280224,7 +281080,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -280480,7 +281336,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -280624,8 +281480,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -281018,7 +281874,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -281273,7 +282133,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -281283,7 +282143,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -281327,8 +282187,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -281343,8 +282203,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -281532,7 +282392,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -281788,7 +282648,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -281932,8 +282792,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -282326,7 +283186,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -282581,7 +283445,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -282591,7 +283455,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -282635,8 +283499,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -282651,8 +283515,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -282840,7 +283704,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -283096,7 +283960,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -283240,8 +284104,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -283634,7 +284498,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -283889,7 +284757,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -283899,7 +284767,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -283943,8 +284811,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -283959,8 +284827,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -284148,7 +285016,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -284404,7 +285272,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -284548,8 +285416,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -284942,7 +285810,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -285197,7 +286069,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -285207,7 +286079,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -285251,8 +286123,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -285267,8 +286139,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -285456,7 +286328,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -285712,7 +286584,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -285856,8 +286728,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -286250,7 +287122,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -286505,7 +287381,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -286515,7 +287391,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -286559,8 +287435,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -286575,8 +287451,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -286764,7 +287640,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -287020,7 +287896,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -287164,8 +288040,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -287558,7 +288434,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -287813,7 +288693,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -287823,7 +288703,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -287867,8 +288747,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -287883,8 +288763,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -288072,7 +288952,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -288328,7 +289208,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -288472,8 +289352,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -288866,7 +289746,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -289121,7 +290005,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -289131,7 +290015,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -289175,8 +290059,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -289191,8 +290075,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -289380,7 +290264,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -289636,7 +290520,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -289780,8 +290664,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -290174,7 +291058,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -290429,7 +291317,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -290439,7 +291327,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -290483,8 +291371,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -290499,8 +291387,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -290688,7 +291576,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -290944,7 +291832,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -291088,8 +291976,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -291482,7 +292370,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -291737,7 +292629,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -291747,7 +292639,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -291791,8 +292683,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -291807,8 +292699,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -291996,7 +292888,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -292252,7 +293144,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -292396,8 +293288,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -292790,7 +293682,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -293045,7 +293941,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -293055,7 +293951,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -293099,8 +293995,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -293115,8 +294011,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -293304,7 +294200,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -293560,7 +294456,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -293704,8 +294600,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -294098,7 +294994,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -294353,7 +295253,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -294363,7 +295263,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -294407,8 +295307,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -294423,8 +295323,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -294612,7 +295512,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -294868,7 +295768,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -295012,8 +295912,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -295406,7 +296306,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -295661,7 +296565,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -295671,7 +296575,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -295715,8 +296619,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -295731,8 +296635,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -295920,7 +296824,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -296176,7 +297080,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -296320,8 +297224,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -296714,7 +297618,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -296969,7 +297877,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -296979,7 +297887,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -297023,8 +297931,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -297039,8 +297947,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -297228,7 +298136,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -297484,7 +298392,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -297628,8 +298536,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -298022,7 +298930,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -298277,7 +299189,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -298287,7 +299199,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -298331,8 +299243,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -298347,8 +299259,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -298536,7 +299448,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -298792,7 +299704,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -298936,8 +299848,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -299330,7 +300242,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -299585,7 +300501,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -299595,7 +300511,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -299639,8 +300555,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -299655,8 +300571,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -299844,7 +300760,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -300100,7 +301016,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -300244,8 +301160,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -300638,7 +301554,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -300893,7 +301813,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -300903,7 +301823,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -300947,8 +301867,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -300963,8 +301883,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -301152,7 +302072,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -301408,7 +302328,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -301552,8 +302472,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -301946,7 +302866,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -302201,7 +303125,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -302211,7 +303135,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -302255,8 +303179,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -302271,8 +303195,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -302460,7 +303384,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -302716,7 +303640,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -302860,8 +303784,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -303254,7 +304178,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -303509,7 +304437,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -303519,7 +304447,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -303563,8 +304491,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -303579,8 +304507,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -303768,7 +304696,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -304024,7 +304952,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -304168,8 +305096,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -304562,7 +305490,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -304817,7 +305749,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -304827,7 +305759,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -304871,8 +305803,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -304887,8 +305819,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -305076,7 +306008,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -305332,7 +306264,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -305476,8 +306408,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -305870,7 +306802,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -306125,7 +307061,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -306135,7 +307071,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -306179,8 +307115,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -306195,8 +307131,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -306384,7 +307320,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -306640,7 +307576,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -306784,8 +307720,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -307178,7 +308114,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -307433,7 +308373,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -307443,7 +308383,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -307487,8 +308427,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -307503,8 +308443,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -307692,7 +308632,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -307948,7 +308888,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -308092,8 +309032,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -308486,7 +309426,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -308741,7 +309685,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -308751,7 +309695,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -308795,8 +309739,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -308811,8 +309755,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -309000,7 +309944,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -309256,7 +310200,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -309400,8 +310344,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -309794,7 +310738,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -310049,7 +310997,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -310059,7 +311007,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -310103,8 +311051,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -310119,8 +311067,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -310308,7 +311256,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -310564,7 +311512,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -310708,8 +311656,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -311102,7 +312050,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -311357,7 +312309,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -311367,7 +312319,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -311411,8 +312363,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -311427,8 +312379,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -311616,7 +312568,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -311872,7 +312824,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -312016,8 +312968,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -312410,7 +313362,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -312665,7 +313621,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -312675,7 +313631,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -312719,8 +313675,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -312735,8 +313691,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -312924,7 +313880,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -313180,7 +314136,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -313324,8 +314280,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -313718,7 +314674,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -313973,7 +314933,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -313983,7 +314943,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -314027,8 +314987,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -314043,8 +315003,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -314232,7 +315192,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -314488,7 +315448,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -314632,8 +315592,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -315026,7 +315986,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -315281,7 +316245,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -315291,7 +316255,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -315335,8 +316299,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -315351,8 +316315,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -315540,7 +316504,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -315796,7 +316760,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -315940,8 +316904,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -316334,7 +317298,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -316589,7 +317557,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -316599,7 +317567,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -316643,8 +317611,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -316659,8 +317627,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -316848,7 +317816,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -317104,7 +318072,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -317248,8 +318216,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -317642,7 +318610,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -317897,7 +318869,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -317907,7 +318879,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -317951,8 +318923,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -317967,8 +318939,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -318156,7 +319128,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -318412,7 +319384,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -318556,8 +319528,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -318950,7 +319922,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -319205,7 +320181,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -319215,7 +320191,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -319259,8 +320235,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -319275,8 +320251,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -319464,7 +320440,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -319720,7 +320696,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -319864,8 +320840,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -320258,7 +321234,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -320513,7 +321493,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -320523,7 +321503,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -320567,8 +321547,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -320583,8 +321563,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -320772,7 +321752,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -321028,7 +322008,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -321172,8 +322152,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -321566,7 +322546,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -321821,7 +322805,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -321831,7 +322815,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -321875,8 +322859,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -321891,8 +322875,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -322080,7 +323064,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -322336,7 +323320,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -322480,8 +323464,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -322874,7 +323858,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -323129,7 +324117,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -323139,7 +324127,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -323183,8 +324171,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -323199,8 +324187,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -323388,7 +324376,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -323644,7 +324632,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -323788,8 +324776,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -324182,7 +325170,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -324437,7 +325429,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -324447,7 +325439,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -324491,8 +325483,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -324507,8 +325499,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -324696,7 +325688,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -324952,7 +325944,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -325096,8 +326088,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -325490,7 +326482,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -325745,7 +326741,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -325755,7 +326751,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -325799,8 +326795,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -325815,8 +326811,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -326004,7 +327000,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -326260,7 +327256,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -326404,8 +327400,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -326798,7 +327794,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -327053,7 +328053,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -327063,7 +328063,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -327107,8 +328107,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -327123,8 +328123,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -327312,7 +328312,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -327568,7 +328568,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -327712,8 +328712,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -328106,7 +329106,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -328361,7 +329365,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -328371,7 +329375,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -328415,8 +329419,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -328431,8 +329435,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -328620,7 +329624,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -328876,7 +329880,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -329020,8 +330024,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -329414,7 +330418,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -329669,7 +330677,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -329679,7 +330687,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -329723,8 +330731,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -329739,8 +330747,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -329928,7 +330936,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -330184,7 +331192,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -330328,8 +331336,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -330722,7 +331730,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -330977,7 +331989,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -330987,7 +331999,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -331031,8 +332043,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -331047,8 +332059,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -331236,7 +332248,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -331492,7 +332504,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -331636,8 +332648,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -332030,7 +333042,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -332285,7 +333301,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -332295,7 +333311,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -332339,8 +333355,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -332355,8 +333371,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -332544,7 +333560,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -332800,7 +333816,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -332944,8 +333960,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -333338,7 +334354,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -333593,7 +334613,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -333603,7 +334623,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -333647,8 +334667,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -333663,8 +334683,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -333852,7 +334872,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -334108,7 +335128,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -334252,8 +335272,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -334646,7 +335666,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -334901,7 +335925,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -334911,7 +335935,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -334955,8 +335979,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -334971,8 +335995,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -335160,7 +336184,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -335416,7 +336440,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -335560,8 +336584,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -335954,7 +336978,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -336209,7 +337237,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -336219,7 +337247,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -336263,8 +337291,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -336279,8 +337307,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -336468,7 +337496,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -336724,7 +337752,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -336868,8 +337896,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -337262,7 +338290,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -337517,7 +338549,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -337527,7 +338559,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -337571,8 +338603,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -337587,8 +338619,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -337776,7 +338808,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -338032,7 +339064,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -338176,8 +339208,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -338570,7 +339602,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -338825,7 +339861,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -338835,7 +339871,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -338879,8 +339915,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -338895,8 +339931,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -339084,7 +340120,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -339340,7 +340376,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -339484,8 +340520,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -339878,7 +340914,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -340133,7 +341173,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -340143,7 +341183,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -340187,8 +341227,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -340203,8 +341243,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -340392,7 +341432,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -340648,7 +341688,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -340792,8 +341832,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -341186,7 +342226,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -341441,7 +342485,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -341451,7 +342495,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -341495,8 +342539,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -341511,8 +342555,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -341700,7 +342744,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -341956,7 +343000,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -342100,8 +343144,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -342494,7 +343538,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -342749,7 +343797,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -342759,7 +343807,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -342803,8 +343851,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -342819,8 +343867,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -343008,7 +344056,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -343264,7 +344312,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -343408,8 +344456,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -343802,7 +344850,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -344057,7 +345109,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -344067,7 +345119,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -344111,8 +345163,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -344127,8 +345179,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -344316,7 +345368,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -344572,7 +345624,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -344716,8 +345768,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -345110,7 +346162,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -345365,7 +346421,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -345375,7 +346431,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -345419,8 +346475,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -345435,8 +346491,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -345624,7 +346680,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -345880,7 +346936,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -346024,8 +347080,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -346418,7 +347474,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -346673,7 +347733,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -346683,7 +347743,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -346727,8 +347787,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -346743,8 +347803,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -346932,7 +347992,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -347188,7 +348248,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -347332,8 +348392,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -347726,7 +348786,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -347981,7 +349045,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -347991,7 +349055,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -348035,8 +349099,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -348051,8 +349115,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -348240,7 +349304,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -348496,7 +349560,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -348640,8 +349704,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -349034,7 +350098,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -349289,7 +350357,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -349299,7 +350367,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -349343,8 +350411,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -349359,8 +350427,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -349548,7 +350616,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -349804,7 +350872,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -349948,8 +351016,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -350342,7 +351410,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -350597,7 +351669,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -350607,7 +351679,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -350651,8 +351723,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -350667,8 +351739,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -350856,7 +351928,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -351112,7 +352184,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -351256,8 +352328,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -351650,7 +352722,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -351905,7 +352981,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -351915,7 +352991,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -351959,8 +353035,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -351975,8 +353051,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -352164,7 +353240,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -352420,7 +353496,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -352564,8 +353640,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -352958,7 +354034,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -353213,7 +354293,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -353223,7 +354303,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -353267,8 +354347,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -353283,8 +354363,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -353472,7 +354552,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -353728,7 +354808,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -353872,8 +354952,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -354266,7 +355346,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -354521,7 +355605,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -354531,7 +355615,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -354575,8 +355659,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -354591,8 +355675,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -354780,7 +355864,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -355036,7 +356120,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -355180,8 +356264,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -355574,7 +356658,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -355829,7 +356917,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -355839,7 +356927,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -355883,8 +356971,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -355899,8 +356987,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -356088,7 +357176,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -356344,7 +357432,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -356488,8 +357576,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -356882,7 +357970,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -357137,7 +358229,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -357147,7 +358239,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -357191,8 +358283,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -357207,8 +358299,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -357396,7 +358488,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -357652,7 +358744,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -357796,8 +358888,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -358190,7 +359282,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -358445,7 +359541,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -358455,7 +359551,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -358499,8 +359595,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -358515,8 +359611,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -358704,7 +359800,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -358960,7 +360056,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -359104,8 +360200,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -359498,7 +360594,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -359753,7 +360853,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -359763,7 +360863,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -359807,8 +360907,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -359823,8 +360923,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -360012,7 +361112,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -360268,7 +361368,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -360412,8 +361512,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -360806,7 +361906,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -361061,7 +362165,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -361071,7 +362175,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -361115,8 +362219,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -361131,8 +362235,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -361320,7 +362424,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -361576,7 +362680,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -361720,8 +362824,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -362114,7 +363218,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -362369,7 +363477,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -362379,7 +363487,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -362423,8 +363531,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -362439,8 +363547,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -362628,7 +363736,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -362884,7 +363992,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -363028,8 +364136,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -363422,7 +364530,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -363677,7 +364789,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -363687,7 +364799,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -363731,8 +364843,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -363747,8 +364859,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -363936,7 +365048,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -364192,7 +365304,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -364336,8 +365448,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -364730,7 +365842,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -364985,7 +366101,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -364995,7 +366111,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -365039,8 +366155,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -365055,8 +366171,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -365244,7 +366360,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -365500,7 +366616,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -365644,8 +366760,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -366038,7 +367154,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -366293,7 +367413,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -366303,7 +367423,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -366347,8 +367467,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -366363,8 +367483,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -366552,7 +367672,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -366808,7 +367928,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -366952,8 +368072,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -367346,7 +368466,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -367601,7 +368725,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -367611,7 +368735,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -367655,8 +368779,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -367671,8 +368795,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -367860,7 +368984,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -368116,7 +369240,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -368260,8 +369384,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -368654,7 +369778,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -368909,7 +370037,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -368919,7 +370047,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -368963,8 +370091,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -368979,8 +370107,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -369168,7 +370296,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -369424,7 +370552,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -369568,8 +370696,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -369962,7 +371090,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -370217,7 +371349,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -370227,7 +371359,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -370271,8 +371403,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -370287,8 +371419,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -370476,7 +371608,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -370732,7 +371864,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -370876,8 +372008,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -371270,7 +372402,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -371525,7 +372661,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -371535,7 +372671,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -371579,8 +372715,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -371595,8 +372731,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -371784,7 +372920,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -372040,7 +373176,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -372184,8 +373320,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -372578,7 +373714,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -372833,7 +373973,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -372843,7 +373983,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -372887,8 +374027,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -372903,8 +374043,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -373092,7 +374232,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -373348,7 +374488,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -373492,8 +374632,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -373886,7 +375026,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -374141,7 +375285,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -374151,7 +375295,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -374195,8 +375339,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -374211,8 +375355,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -374400,7 +375544,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -374656,7 +375800,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -374800,8 +375944,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -375194,7 +376338,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -375449,7 +376597,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -375459,7 +376607,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -375503,8 +376651,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -375519,8 +376667,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -375708,7 +376856,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -375964,7 +377112,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -376108,8 +377256,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -376502,7 +377650,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -376757,7 +377909,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -376767,7 +377919,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -376811,8 +377963,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -376827,8 +377979,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -377016,7 +378168,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -377272,7 +378424,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -377416,8 +378568,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -377810,7 +378962,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -378065,7 +379221,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -378075,7 +379231,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -378119,8 +379275,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -378135,8 +379291,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -378324,7 +379480,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -378580,7 +379736,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -378724,8 +379880,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -379118,7 +380274,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -379373,7 +380533,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -379383,7 +380543,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -379427,8 +380587,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -379443,8 +380603,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -379632,7 +380792,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -379888,7 +381048,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -380032,8 +381192,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -380426,7 +381586,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -380681,7 +381845,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -380691,7 +381855,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -380735,8 +381899,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -380751,8 +381915,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -380940,7 +382104,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -381196,7 +382360,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -381340,8 +382504,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -381734,7 +382898,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -381989,7 +383157,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -381999,7 +383167,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -382043,8 +383211,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -382059,8 +383227,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -382248,7 +383416,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -382504,7 +383672,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -382648,8 +383816,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -383042,7 +384210,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -383297,7 +384469,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -383307,7 +384479,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -383351,8 +384523,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -383367,8 +384539,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -383556,7 +384728,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -383812,7 +384984,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -383956,8 +385128,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -384350,7 +385522,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -384605,7 +385781,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -384615,7 +385791,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -384659,8 +385835,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -384675,8 +385851,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -384864,7 +386040,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -385120,7 +386296,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -385264,8 +386440,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -385658,7 +386834,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -385913,7 +387093,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -385923,7 +387103,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -385967,8 +387147,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -385983,8 +387163,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -386172,7 +387352,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -386428,7 +387608,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -386572,8 +387752,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -386966,7 +388146,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -387221,7 +388405,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -387231,7 +388415,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -387275,8 +388459,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -387291,8 +388475,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -387480,7 +388664,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -387736,7 +388920,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -387880,8 +389064,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -388274,7 +389458,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -388529,7 +389717,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -388539,7 +389727,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -388583,8 +389771,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -388599,8 +389787,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -388788,7 +389976,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -389044,7 +390232,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -389188,8 +390376,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -389582,7 +390770,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -389837,7 +391029,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -389847,7 +391039,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -389891,8 +391083,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -389907,8 +391099,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -390096,7 +391288,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -390352,7 +391544,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -390496,8 +391688,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -390890,7 +392082,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -391145,7 +392341,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -391155,7 +392351,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -391199,8 +392395,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -391215,8 +392411,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -391404,7 +392600,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -391660,7 +392856,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -391804,8 +393000,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -392198,7 +393394,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -392453,7 +393653,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -392463,7 +393663,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -392507,8 +393707,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -392523,8 +393723,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -392712,7 +393912,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -392968,7 +394168,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -393112,8 +394312,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -393506,7 +394706,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -393761,7 +394965,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -393771,7 +394975,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -393815,8 +395019,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -393831,8 +395035,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -394020,7 +395224,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -394276,7 +395480,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -394420,8 +395624,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -394814,7 +396018,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -395069,7 +396277,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -395079,7 +396287,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -395123,8 +396331,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -395139,8 +396347,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -395328,7 +396536,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -395584,7 +396792,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -395728,8 +396936,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -396122,7 +397330,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -396377,7 +397589,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -396387,7 +397599,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -396431,8 +397643,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -396447,8 +397659,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -396636,7 +397848,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -396892,7 +398104,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -397036,8 +398248,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -397430,7 +398642,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -397685,7 +398901,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -397695,7 +398911,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -397739,8 +398955,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -397755,8 +398971,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -397944,7 +399160,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -398200,7 +399416,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -398344,8 +399560,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -398738,7 +399954,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -398993,7 +400213,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -399003,7 +400223,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -399047,8 +400267,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -399063,8 +400283,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -399252,7 +400472,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -399508,7 +400728,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -399652,8 +400872,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -400046,7 +401266,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -400301,7 +401525,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -400311,7 +401535,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -400355,8 +401579,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -400371,8 +401595,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -400560,7 +401784,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -400816,7 +402040,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -400960,8 +402184,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -401354,7 +402578,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -401609,7 +402837,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -401619,7 +402847,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -401663,8 +402891,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -401679,8 +402907,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -401868,7 +403096,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -402124,7 +403352,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -402268,8 +403496,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -402662,7 +403890,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -402917,7 +404149,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -402927,7 +404159,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -402971,8 +404203,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -402987,8 +404219,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -403176,7 +404408,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -403432,7 +404664,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -403576,8 +404808,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -403970,7 +405202,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -404225,7 +405461,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -404235,7 +405471,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -404279,8 +405515,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -404295,8 +405531,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -404484,7 +405720,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -404740,7 +405976,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -404884,8 +406120,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -405278,7 +406514,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -405533,7 +406773,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -405543,7 +406783,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -405587,8 +406827,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -405603,8 +406843,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -405792,7 +407032,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -406048,7 +407288,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -406192,8 +407432,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -406586,7 +407826,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -406841,7 +408085,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -406851,7 +408095,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -406895,8 +408139,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -406911,8 +408155,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -407100,7 +408344,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -407356,7 +408600,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -407500,8 +408744,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -407894,7 +409138,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -408149,7 +409397,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -408159,7 +409407,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -408203,8 +409451,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -408219,8 +409467,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -408408,7 +409656,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -408664,7 +409912,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -408808,8 +410056,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -409202,7 +410450,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -409457,7 +410709,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -409467,7 +410719,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -409511,8 +410763,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -409527,8 +410779,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -409716,7 +410968,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -409972,7 +411224,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -410116,8 +411368,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -410510,7 +411762,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -410765,7 +412021,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -410775,7 +412031,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -410819,8 +412075,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -410835,8 +412091,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -411024,7 +412280,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -411280,7 +412536,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -411424,8 +412680,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -411818,7 +413074,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -412073,7 +413333,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -412083,7 +413343,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -412127,8 +413387,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -412143,8 +413403,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -412332,7 +413592,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -412588,7 +413848,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -412732,8 +413992,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -413126,7 +414386,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -413381,7 +414645,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -413391,7 +414655,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -413435,8 +414699,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -413451,8 +414715,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -413640,7 +414904,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -413896,7 +415160,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -414040,8 +415304,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -414434,7 +415698,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -414689,7 +415957,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -414699,7 +415967,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -414743,8 +416011,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -414759,8 +416027,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -414948,7 +416216,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -415204,7 +416472,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -415348,8 +416616,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -415742,7 +417010,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -415997,7 +417269,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -416007,7 +417279,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -416051,8 +417323,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -416067,8 +417339,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -416256,7 +417528,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -416512,7 +417784,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -416656,8 +417928,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -417050,7 +418322,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -417305,7 +418581,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -417315,7 +418591,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -417359,8 +418635,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -417375,8 +418651,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -417564,7 +418840,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -417820,7 +419096,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -417964,8 +419240,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -418358,7 +419634,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -418613,7 +419893,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -418623,7 +419903,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -418667,8 +419947,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -418683,8 +419963,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -418872,7 +420152,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -419128,7 +420408,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -419272,8 +420552,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -419666,7 +420946,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -419921,7 +421205,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -419931,7 +421215,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -419975,8 +421259,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -419991,8 +421275,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -420180,7 +421464,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -420436,7 +421720,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -420580,8 +421864,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -420974,7 +422258,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -421229,7 +422517,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -421239,7 +422527,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -421283,8 +422571,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -421299,8 +422587,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -421488,7 +422776,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -421744,7 +423032,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -421888,8 +423176,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -422282,7 +423570,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -422537,7 +423829,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -422547,7 +423839,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -422591,8 +423883,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -422607,8 +423899,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -422796,7 +424088,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -423052,7 +424344,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -423196,8 +424488,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -423590,7 +424882,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -423845,7 +425141,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -423855,7 +425151,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -423899,8 +425195,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -423915,8 +425211,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -424104,7 +425400,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -424360,7 +425656,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -424504,8 +425800,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -424898,7 +426194,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -425153,7 +426453,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -425163,7 +426463,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -425207,8 +426507,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -425223,8 +426523,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -425412,7 +426712,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -425668,7 +426968,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -425812,8 +427112,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -426206,7 +427506,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -426461,7 +427765,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -426471,7 +427775,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -426515,8 +427819,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -426531,8 +427835,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -426720,7 +428024,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -426976,7 +428280,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -427120,8 +428424,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -427514,7 +428818,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -427769,7 +429077,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -427779,7 +429087,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -427823,8 +429131,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -427839,8 +429147,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -428028,7 +429336,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -428284,7 +429592,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -428428,8 +429736,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -428822,7 +430130,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -429077,7 +430389,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -429087,7 +430399,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -429131,8 +430443,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -429147,8 +430459,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -429336,7 +430648,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -429592,7 +430904,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -429736,8 +431048,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -430130,7 +431442,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -430385,7 +431701,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -430395,7 +431711,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -430439,8 +431755,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -430455,8 +431771,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -430644,7 +431960,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -430900,7 +432216,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -431044,8 +432360,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -431438,7 +432754,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -431693,7 +433013,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -431703,7 +433023,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -431747,8 +433067,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -431763,8 +433083,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -431952,7 +433272,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -432208,7 +433528,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -432352,8 +433672,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -432746,7 +434066,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -433001,7 +434325,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -433011,7 +434335,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -433055,8 +434379,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -433071,8 +434395,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -433260,7 +434584,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -433516,7 +434840,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -433660,8 +434984,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -434054,7 +435378,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -434309,7 +435637,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -434319,7 +435647,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -434363,8 +435691,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -434379,8 +435707,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -434568,7 +435896,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -434824,7 +436152,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -434968,8 +436296,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -435362,7 +436690,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -435617,7 +436949,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -435627,7 +436959,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -435671,8 +437003,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -435687,8 +437019,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -435876,7 +437208,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -436132,7 +437464,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -436276,8 +437608,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -436670,7 +438002,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -436925,7 +438261,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -436935,7 +438271,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -436979,8 +438315,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -436995,8 +438331,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -437184,7 +438520,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -437440,7 +438776,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -437584,8 +438920,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -437978,7 +439314,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -438233,7 +439573,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -438243,7 +439583,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -438287,8 +439627,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -438303,8 +439643,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -438492,7 +439832,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -438748,7 +440088,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -438892,8 +440232,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -439286,7 +440626,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -439541,7 +440885,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -439551,7 +440895,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -439595,8 +440939,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -439611,8 +440955,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -439800,7 +441144,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -440056,7 +441400,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -440200,8 +441544,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -440594,7 +441938,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -440849,7 +442197,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -440859,7 +442207,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -440903,8 +442251,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -440919,8 +442267,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -441108,7 +442456,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -441364,7 +442712,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -441508,8 +442856,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -441902,7 +443250,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -442157,7 +443509,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -442167,7 +443519,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -442211,8 +443563,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -442227,8 +443579,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -442416,7 +443768,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -442672,7 +444024,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -442816,8 +444168,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -443210,7 +444562,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -443465,7 +444821,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -443475,7 +444831,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -443519,8 +444875,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -443535,8 +444891,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -443724,7 +445080,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -443980,7 +445336,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -444124,8 +445480,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -444518,7 +445874,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -444773,7 +446133,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -444783,7 +446143,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -444827,8 +446187,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -444843,8 +446203,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -445032,7 +446392,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -445288,7 +446648,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -445432,8 +446792,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -445826,7 +447186,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -446081,7 +447445,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -446091,7 +447455,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -446135,8 +447499,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -446151,8 +447515,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -446340,7 +447704,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -446596,7 +447960,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -446740,8 +448104,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -447134,7 +448498,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -447389,7 +448757,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -447399,7 +448767,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -447443,8 +448811,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -447459,8 +448827,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -447648,7 +449016,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -447904,7 +449272,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -448048,8 +449416,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -448442,7 +449810,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -448697,7 +450069,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -448707,7 +450079,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -448751,8 +450123,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -448767,8 +450139,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -448956,7 +450328,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -449212,7 +450584,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -449356,8 +450728,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -449750,7 +451122,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -450005,7 +451381,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -450015,7 +451391,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -450059,8 +451435,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -450075,8 +451451,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -450264,7 +451640,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -450520,7 +451896,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -450664,8 +452040,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -451058,7 +452434,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -451313,7 +452693,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -451323,7 +452703,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -451367,8 +452747,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -451383,8 +452763,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -451572,7 +452952,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -451828,7 +453208,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -451972,8 +453352,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -452366,7 +453746,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -452621,7 +454005,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -452631,7 +454015,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -452675,8 +454059,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -452691,8 +454075,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -452880,7 +454264,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -453136,7 +454520,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -453280,8 +454664,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -453674,7 +455058,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -453929,7 +455317,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -453939,7 +455327,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -453983,8 +455371,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -453999,8 +455387,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -454188,7 +455576,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -454444,7 +455832,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -454588,8 +455976,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -454982,7 +456370,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -455237,7 +456629,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -455247,7 +456639,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -455291,8 +456683,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -455307,8 +456699,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -455496,7 +456888,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -455752,7 +457144,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -455896,8 +457288,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -456290,7 +457682,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -456545,7 +457941,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -456555,7 +457951,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -456599,8 +457995,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -456615,8 +458011,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -456804,7 +458200,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -457060,7 +458456,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -457204,8 +458600,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -457598,7 +458994,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -457853,7 +459253,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -457863,7 +459263,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -457907,8 +459307,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -457923,8 +459323,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -458112,7 +459512,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -458368,7 +459768,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -458512,8 +459912,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -458906,7 +460306,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -459161,7 +460565,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -459171,7 +460575,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -459215,8 +460619,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -459231,8 +460635,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -459420,7 +460824,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -459676,7 +461080,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -459820,8 +461224,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -460214,7 +461618,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -460469,7 +461877,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -460479,7 +461887,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -460523,8 +461931,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -460539,8 +461947,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -460728,7 +462136,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -460984,7 +462392,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -461128,8 +462536,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -461522,7 +462930,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -461777,7 +463189,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -461787,7 +463199,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -461831,8 +463243,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -461847,8 +463259,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -462036,7 +463448,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -462292,7 +463704,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -462436,8 +463848,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -462830,7 +464242,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -463085,7 +464501,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -463095,7 +464511,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -463139,8 +464555,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -463155,8 +464571,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -463344,7 +464760,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -463600,7 +465016,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -463744,8 +465160,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -464138,7 +465554,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -464393,7 +465813,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -464403,7 +465823,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -464447,8 +465867,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -464463,8 +465883,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -464652,7 +466072,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -464908,7 +466328,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -465052,8 +466472,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -465446,7 +466866,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -465701,7 +467125,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -465711,7 +467135,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -465755,8 +467179,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -465771,8 +467195,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -465960,7 +467384,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -466216,7 +467640,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -466360,8 +467784,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -466754,7 +468178,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -467009,7 +468437,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -467019,7 +468447,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -467063,8 +468491,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -467079,8 +468507,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -467268,7 +468696,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -467524,7 +468952,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -467668,8 +469096,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -468062,7 +469490,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -468317,7 +469749,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -468327,7 +469759,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -468371,8 +469803,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -468387,8 +469819,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -468576,7 +470008,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -468832,7 +470264,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -468976,8 +470408,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -469370,7 +470802,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -469625,7 +471061,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -469635,7 +471071,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -469679,8 +471115,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -469695,8 +471131,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -469884,7 +471320,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -470140,7 +471576,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -470284,8 +471720,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -470678,7 +472114,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -470933,7 +472373,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -470943,7 +472383,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -470987,8 +472427,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -471003,8 +472443,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -471192,7 +472632,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -471448,7 +472888,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -471592,8 +473032,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -471986,7 +473426,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -472241,7 +473685,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -472251,7 +473695,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -472295,8 +473739,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -472311,8 +473755,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -472500,7 +473944,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -472756,7 +474200,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -472900,8 +474344,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -473294,7 +474738,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -473549,7 +474997,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -473559,7 +475007,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -473603,8 +475051,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -473619,8 +475067,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -473808,7 +475256,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -474064,7 +475512,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -474208,8 +475656,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -474602,7 +476050,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -474857,7 +476309,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -474867,7 +476319,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -474911,8 +476363,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -474927,8 +476379,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -475116,7 +476568,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -475372,7 +476824,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -475516,8 +476968,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -475910,7 +477362,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -476165,7 +477621,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -476175,7 +477631,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -476219,8 +477675,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -476235,8 +477691,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -476424,7 +477880,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -476680,7 +478136,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -476824,8 +478280,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -477218,7 +478674,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -477473,7 +478933,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -477483,7 +478943,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -477527,8 +478987,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -477543,8 +479003,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -477732,7 +479192,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -477988,7 +479448,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -478132,8 +479592,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -478526,7 +479986,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
@@ -478781,7 +480245,7 @@
         {
             "techniqueID": "T1592",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_recon_running_process_or_services.yml"
         },
         {},
         {},
@@ -478791,7 +480255,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 35,
+            "score": 37,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -478835,8 +480299,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {},
         {},
@@ -478851,8 +480315,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "score": 7,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {},
         {},
@@ -479040,7 +480504,7 @@
         {
             "techniqueID": "T1053",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -479296,7 +480760,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 11,
+            "score": 16,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -479440,8 +480904,8 @@
         {},
         {
             "techniqueID": "T1218.005",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {},
         {},
@@ -479834,7 +481298,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1537",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/detect_shared_ec2_snapshot.yml"
+        },
         {},
         {},
         {
diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv
index f18195cc98..91cf82cfea 100644
--- a/docs/mitre-map/detections.csv
+++ b/docs/mitre-map/detections.csv
@@ -107164,11 +107164,16 @@ T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/end
 T1173,No,-,10
 T1124,No,-,10
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107183,12 +107188,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107198,11 +107205,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107217,12 +107229,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107232,11 +107246,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107251,12 +107270,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107266,11 +107287,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107285,12 +107311,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107300,11 +107328,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107319,12 +107352,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107334,11 +107369,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107353,12 +107393,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107368,11 +107410,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107387,12 +107434,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107402,11 +107451,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107421,12 +107475,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107436,11 +107492,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107455,12 +107516,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107470,11 +107533,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107489,12 +107557,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107504,11 +107574,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107523,12 +107598,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107538,11 +107615,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107557,12 +107639,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107572,11 +107656,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107591,12 +107680,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107606,11 +107697,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107625,12 +107721,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107640,11 +107738,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107659,12 +107762,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107674,11 +107779,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107693,12 +107803,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107708,11 +107820,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107727,12 +107844,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107742,11 +107861,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107761,12 +107885,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107776,11 +107902,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107795,12 +107926,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107810,11 +107943,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107829,12 +107967,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107844,11 +107984,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107863,12 +108008,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107878,11 +108025,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107897,12 +108049,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107912,11 +108066,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107931,12 +108090,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107946,11 +108107,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107965,12 +108131,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -107980,11 +108148,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -107999,12 +108172,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108014,11 +108189,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108033,12 +108213,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108048,11 +108230,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108067,12 +108254,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108082,11 +108271,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108101,12 +108295,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108116,11 +108312,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108135,12 +108336,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108150,11 +108353,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108169,12 +108377,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108184,11 +108394,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108203,12 +108418,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108218,11 +108435,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108237,12 +108459,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108252,11 +108476,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108271,12 +108500,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108286,11 +108517,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108305,12 +108541,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108320,11 +108558,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108339,12 +108582,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108354,11 +108599,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108373,12 +108623,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108388,11 +108640,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108407,12 +108664,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108422,11 +108681,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108441,12 +108705,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108456,11 +108722,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108475,12 +108746,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108490,11 +108763,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108509,12 +108787,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108524,11 +108804,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108543,12 +108828,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108558,11 +108845,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108577,12 +108869,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108592,11 +108886,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108611,12 +108910,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108626,11 +108927,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108645,12 +108951,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108660,11 +108968,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108679,12 +108992,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108694,11 +109009,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108713,12 +109033,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108728,11 +109050,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108747,12 +109074,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108762,11 +109091,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108781,12 +109115,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108796,11 +109132,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108815,12 +109156,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108830,11 +109173,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108849,12 +109197,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108864,11 +109214,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108883,12 +109238,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108898,11 +109255,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108917,12 +109279,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108932,11 +109296,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108951,12 +109320,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -108966,11 +109337,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -108985,12 +109361,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109000,11 +109378,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109019,12 +109402,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109034,11 +109419,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109053,12 +109443,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109068,11 +109460,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109087,12 +109484,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109102,11 +109501,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109121,12 +109525,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109136,11 +109542,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109155,12 +109566,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109170,11 +109583,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109189,12 +109607,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109204,11 +109624,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109223,12 +109648,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109238,11 +109665,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109257,12 +109689,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109272,11 +109706,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109291,12 +109730,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109306,11 +109747,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109325,12 +109771,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109340,11 +109788,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109359,12 +109812,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109374,11 +109829,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109393,12 +109853,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109408,11 +109870,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109427,12 +109894,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109442,11 +109911,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109461,12 +109935,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109476,11 +109952,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109495,12 +109976,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109510,11 +109993,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109529,12 +110017,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109544,11 +110034,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109563,12 +110058,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109578,11 +110075,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109597,12 +110099,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109612,11 +110116,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109631,12 +110140,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109646,11 +110157,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109665,12 +110181,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109680,11 +110198,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109699,12 +110222,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109714,11 +110239,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109733,12 +110263,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109748,11 +110280,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109767,12 +110304,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109782,11 +110321,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109801,12 +110345,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109816,11 +110362,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109835,12 +110386,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109850,11 +110403,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109869,12 +110427,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109884,11 +110444,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109903,12 +110468,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109918,11 +110485,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109937,12 +110509,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109952,11 +110526,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -109971,12 +110550,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -109986,11 +110567,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110005,12 +110591,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110020,11 +110608,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110039,12 +110632,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110054,11 +110649,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110073,12 +110673,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110088,11 +110690,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110107,12 +110714,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110122,11 +110731,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110141,12 +110755,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110156,11 +110772,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110175,12 +110796,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110190,11 +110813,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110209,12 +110837,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110224,11 +110854,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110243,12 +110878,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110258,11 +110895,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110277,12 +110919,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110292,11 +110936,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110311,12 +110960,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110326,11 +110977,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110345,12 +111001,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110360,11 +111018,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110379,12 +111042,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110394,11 +111059,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110413,12 +111083,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110428,11 +111100,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110447,12 +111124,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110462,11 +111141,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110481,12 +111165,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110496,11 +111182,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110515,12 +111206,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110530,11 +111223,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110549,12 +111247,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110564,11 +111264,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110583,12 +111288,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110598,11 +111305,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110617,12 +111329,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110632,11 +111346,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110651,12 +111370,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110666,11 +111387,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110685,12 +111411,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110700,11 +111428,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110719,12 +111452,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110734,11 +111469,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110753,12 +111493,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110768,11 +111510,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110787,12 +111534,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110802,11 +111551,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110821,12 +111575,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110836,11 +111592,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110855,12 +111616,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110870,11 +111633,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110889,12 +111657,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110904,11 +111674,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110923,12 +111698,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110938,11 +111715,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110957,12 +111739,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -110972,11 +111756,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -110991,12 +111780,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111006,11 +111797,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111025,12 +111821,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111040,11 +111838,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111059,12 +111862,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111074,11 +111879,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111093,12 +111903,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111108,11 +111920,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111127,12 +111944,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111142,11 +111961,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111161,12 +111985,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111176,11 +112002,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111195,12 +112026,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111210,11 +112043,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111229,12 +112067,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111244,11 +112084,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111263,12 +112108,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111278,11 +112125,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111297,12 +112149,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111312,11 +112166,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111331,12 +112190,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111346,11 +112207,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111365,12 +112231,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111380,11 +112248,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111399,12 +112272,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111414,11 +112289,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111433,12 +112313,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111448,11 +112330,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111467,12 +112354,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111482,11 +112371,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111501,12 +112395,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111516,11 +112412,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111535,12 +112436,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111550,11 +112453,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111569,12 +112477,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111584,11 +112494,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111603,12 +112518,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111618,11 +112535,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111637,12 +112559,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111652,11 +112576,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111671,12 +112600,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111686,11 +112617,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111705,12 +112641,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111720,11 +112658,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111739,12 +112682,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111754,11 +112699,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111773,12 +112723,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111788,11 +112740,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111807,12 +112764,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111822,11 +112781,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111841,12 +112805,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111856,11 +112822,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111875,12 +112846,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111890,11 +112863,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111909,12 +112887,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111924,11 +112904,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111943,12 +112928,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111958,11 +112945,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -111977,12 +112969,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -111992,11 +112986,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112011,12 +113010,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112026,11 +113027,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112045,12 +113051,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112060,11 +113068,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112079,12 +113092,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112094,11 +113109,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112113,12 +113133,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112128,11 +113150,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112147,12 +113174,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112162,11 +113191,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112181,12 +113215,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112196,11 +113232,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112215,12 +113256,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112230,11 +113273,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112249,12 +113297,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112264,11 +113314,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112283,12 +113338,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112298,11 +113355,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112317,12 +113379,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112332,11 +113396,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112351,12 +113420,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112366,11 +113437,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112385,12 +113461,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112400,11 +113478,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112419,12 +113502,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112434,11 +113519,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112453,12 +113543,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112468,11 +113560,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112487,12 +113584,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112502,11 +113601,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112521,12 +113625,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112536,11 +113642,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112555,12 +113666,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112570,11 +113683,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112589,12 +113707,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112604,11 +113724,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112623,12 +113748,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112638,11 +113765,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112657,12 +113789,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112672,11 +113806,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112691,12 +113830,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112706,11 +113847,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112725,12 +113871,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112740,11 +113888,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112759,12 +113912,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112774,11 +113929,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112793,12 +113953,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112808,11 +113970,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112827,12 +113994,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112842,11 +114011,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112861,12 +114035,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112876,11 +114052,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112895,12 +114076,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112910,11 +114093,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112929,12 +114117,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112944,11 +114134,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112963,12 +114158,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -112978,11 +114175,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -112997,12 +114199,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113012,11 +114216,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113031,12 +114240,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113046,11 +114257,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113065,12 +114281,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113080,11 +114298,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113099,12 +114322,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113114,11 +114339,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113133,12 +114363,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113148,11 +114380,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113167,12 +114404,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113182,11 +114421,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113201,12 +114445,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113216,11 +114462,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113235,12 +114486,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113250,11 +114503,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113269,12 +114527,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113284,11 +114544,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113303,12 +114568,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113318,11 +114585,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113337,12 +114609,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113352,11 +114626,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113371,12 +114650,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113386,11 +114667,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113405,12 +114691,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113420,11 +114708,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113439,12 +114732,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113454,11 +114749,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113473,12 +114773,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113488,11 +114790,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113507,12 +114814,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113522,11 +114831,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113541,12 +114855,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113556,11 +114872,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113575,12 +114896,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113590,11 +114913,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113609,12 +114937,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113624,11 +114954,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113643,12 +114978,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113658,11 +114995,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113677,12 +115019,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113692,11 +115036,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113711,12 +115060,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113726,11 +115077,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113745,12 +115101,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113760,11 +115118,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113779,12 +115142,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113794,11 +115159,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113813,12 +115183,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113828,11 +115200,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113847,12 +115224,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113862,11 +115241,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113881,12 +115265,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113896,11 +115282,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113915,12 +115306,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113930,11 +115323,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113949,12 +115347,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113964,11 +115364,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -113983,12 +115388,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -113998,11 +115405,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114017,12 +115429,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114032,11 +115446,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114051,12 +115470,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114066,11 +115487,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114085,12 +115511,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114100,11 +115528,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114119,12 +115552,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114134,11 +115569,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114153,12 +115593,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114168,11 +115610,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114187,12 +115634,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114202,11 +115651,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114221,12 +115675,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114236,11 +115692,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114255,12 +115716,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114270,11 +115733,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114289,12 +115757,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114304,11 +115774,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114323,12 +115798,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114338,11 +115815,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114357,12 +115839,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114372,11 +115856,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114391,12 +115880,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114406,11 +115897,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114425,12 +115921,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114440,11 +115938,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114459,12 +115962,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114474,11 +115979,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114493,12 +116003,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114508,11 +116020,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114527,12 +116044,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114542,11 +116061,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114561,12 +116085,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114576,11 +116102,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114595,12 +116126,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114610,11 +116143,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114629,12 +116167,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114644,11 +116184,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114663,12 +116208,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114678,11 +116225,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114697,12 +116249,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114712,11 +116266,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114731,12 +116290,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114746,11 +116307,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114765,12 +116331,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114780,11 +116348,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114799,12 +116372,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114814,11 +116389,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114833,12 +116413,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114848,11 +116430,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114867,12 +116454,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114882,11 +116471,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114901,12 +116495,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114916,11 +116512,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114935,12 +116536,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114950,11 +116553,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -114969,12 +116577,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -114984,11 +116594,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115003,12 +116618,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115018,11 +116635,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115037,12 +116659,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115052,11 +116676,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115071,12 +116700,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115086,11 +116717,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115105,12 +116741,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115120,11 +116758,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115139,12 +116782,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115154,11 +116799,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115173,12 +116823,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115188,11 +116840,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115207,12 +116864,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115222,11 +116881,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115241,12 +116905,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115256,11 +116922,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115275,12 +116946,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115290,11 +116963,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115309,12 +116987,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115324,11 +117004,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115343,12 +117028,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115358,11 +117045,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115377,12 +117069,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115392,11 +117086,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115411,12 +117110,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115426,11 +117127,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115445,12 +117151,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115460,11 +117168,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115479,12 +117192,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115494,11 +117209,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115513,12 +117233,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115528,11 +117250,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115547,12 +117274,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115562,11 +117291,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115581,12 +117315,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115596,11 +117332,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115615,12 +117356,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115630,11 +117373,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115649,12 +117397,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115664,11 +117414,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115683,12 +117438,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115698,11 +117455,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115717,12 +117479,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115732,11 +117496,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115751,12 +117520,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115766,11 +117537,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115785,12 +117561,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115800,11 +117578,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115819,12 +117602,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115834,11 +117619,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115853,12 +117643,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115868,11 +117660,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115887,12 +117684,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115902,11 +117701,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115921,12 +117725,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115936,11 +117742,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115955,12 +117766,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -115970,11 +117783,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -115989,12 +117807,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116004,11 +117824,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116023,12 +117848,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116038,11 +117865,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116057,12 +117889,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116072,11 +117906,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116091,12 +117930,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116106,11 +117947,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116125,12 +117971,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116140,11 +117988,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116159,12 +118012,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116174,11 +118029,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116193,12 +118053,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116208,11 +118070,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116227,12 +118094,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116242,11 +118111,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116261,12 +118135,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116276,11 +118152,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116295,12 +118176,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116310,11 +118193,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116329,12 +118217,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116344,11 +118234,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116363,12 +118258,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116378,11 +118275,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116397,12 +118299,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116412,11 +118316,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116431,12 +118340,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116446,11 +118357,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116465,12 +118381,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116480,11 +118398,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116499,12 +118422,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116514,11 +118439,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116533,12 +118463,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116548,11 +118480,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116567,12 +118504,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116582,11 +118521,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116601,12 +118545,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116616,11 +118562,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116635,12 +118586,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116650,11 +118603,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116669,12 +118627,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116684,11 +118644,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116703,12 +118668,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116718,11 +118685,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116737,12 +118709,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116752,11 +118726,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116771,12 +118750,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116786,11 +118767,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116805,12 +118791,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116820,11 +118808,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116839,12 +118832,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116854,11 +118849,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116873,12 +118873,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116888,11 +118890,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116907,12 +118914,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116922,11 +118931,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116941,12 +118955,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116956,11 +118972,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -116975,12 +118996,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -116990,11 +119013,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117009,12 +119037,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117024,11 +119054,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117043,12 +119078,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117058,11 +119095,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117077,12 +119119,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117092,11 +119136,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117111,12 +119160,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117126,11 +119177,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117145,12 +119201,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117160,11 +119218,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117179,12 +119242,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117194,11 +119259,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117213,12 +119283,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117228,11 +119300,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117247,12 +119324,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117262,11 +119341,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117281,12 +119365,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117296,11 +119382,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117315,12 +119406,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117330,11 +119423,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117349,12 +119447,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117364,11 +119464,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117383,12 +119488,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117398,11 +119505,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117417,12 +119529,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117432,11 +119546,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117451,12 +119570,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117466,11 +119587,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117485,12 +119611,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117500,11 +119628,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117519,12 +119652,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117534,11 +119669,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117553,12 +119693,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117568,11 +119710,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117587,12 +119734,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117602,11 +119751,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117621,12 +119775,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117636,11 +119792,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117655,12 +119816,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117670,11 +119833,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117689,12 +119857,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117704,11 +119874,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117723,12 +119898,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117738,11 +119915,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117757,12 +119939,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117772,11 +119956,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117791,12 +119980,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117806,11 +119997,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117825,12 +120021,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117840,11 +120038,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117859,12 +120062,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117874,11 +120079,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117893,12 +120103,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117908,11 +120120,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117927,12 +120144,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117942,11 +120161,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117961,12 +120185,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -117976,11 +120202,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -117995,12 +120226,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118010,11 +120243,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118029,12 +120267,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118044,11 +120284,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118063,12 +120308,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118078,11 +120325,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118097,12 +120349,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118112,11 +120366,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118131,12 +120390,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118146,11 +120407,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118165,12 +120431,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118180,11 +120448,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118199,12 +120472,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118214,11 +120489,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118233,12 +120513,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118248,11 +120530,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118267,12 +120554,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118282,11 +120571,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118301,12 +120595,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118316,11 +120612,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118335,12 +120636,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118350,11 +120653,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118369,12 +120677,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118384,11 +120694,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118403,12 +120718,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118418,11 +120735,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118437,12 +120759,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118452,11 +120776,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118471,12 +120800,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118486,11 +120817,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118505,12 +120841,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118520,11 +120858,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118539,12 +120882,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118554,11 +120899,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118573,12 +120923,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118588,11 +120940,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118607,12 +120964,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118622,11 +120981,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118641,12 +121005,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118656,11 +121022,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118675,12 +121046,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118690,11 +121063,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118709,12 +121087,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118724,11 +121104,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118743,12 +121128,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118758,11 +121145,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118777,12 +121169,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118792,11 +121186,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118811,12 +121210,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118826,11 +121227,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118845,12 +121251,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118860,11 +121268,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118879,12 +121292,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118894,11 +121309,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118913,12 +121333,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118928,11 +121350,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118947,12 +121374,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118962,11 +121391,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -118981,12 +121415,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -118996,11 +121432,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119015,12 +121456,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119030,11 +121473,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119049,12 +121497,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119064,11 +121514,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119083,12 +121538,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119098,11 +121555,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119117,12 +121579,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119132,11 +121596,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119151,12 +121620,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119166,11 +121637,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119185,12 +121661,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119200,11 +121678,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119219,12 +121702,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119234,11 +121719,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119253,12 +121743,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119268,11 +121760,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119287,12 +121784,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119302,11 +121801,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119321,12 +121825,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119336,11 +121842,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119355,12 +121866,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119370,11 +121883,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119389,12 +121907,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119404,11 +121924,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119423,12 +121948,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119438,11 +121965,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119457,12 +121989,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119472,11 +122006,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119491,12 +122030,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119506,11 +122047,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119525,12 +122071,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119540,11 +122088,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119559,12 +122112,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119574,11 +122129,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119593,12 +122153,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -119608,11 +122170,16 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,4
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml,-1
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml,-1
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml,7
@@ -119627,12 +122194,14 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml,3
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml,8
 T1090.002,No,-,9
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,3
-T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,3
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml,1
+T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml,1
 T1583.006,No,-,9
 T1170,No,-,9
 T1584.006,No,-,9
@@ -130285,11 +132854,13 @@ T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/network/plain_http_post_exfiltrated_data.yml,2
 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml,7
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130328,11 +132899,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130371,11 +132944,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130414,11 +132989,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130457,11 +133034,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130500,11 +133079,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130543,11 +133124,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130586,11 +133169,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130629,11 +133214,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130672,11 +133259,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130715,11 +133304,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130758,11 +133349,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130801,11 +133394,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130844,11 +133439,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130887,11 +133484,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130930,11 +133529,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -130973,11 +133574,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131016,11 +133619,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131059,11 +133664,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131102,11 +133709,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131145,11 +133754,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131188,11 +133799,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131231,11 +133844,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131274,11 +133889,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131317,11 +133934,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131360,11 +133979,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131403,11 +134024,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131446,11 +134069,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131489,11 +134114,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131532,11 +134159,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131575,11 +134204,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131618,11 +134249,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131661,11 +134294,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131704,11 +134339,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131747,11 +134384,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131790,11 +134429,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131833,11 +134474,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131876,11 +134519,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131919,11 +134564,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -131962,11 +134609,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132005,11 +134654,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132048,11 +134699,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132091,11 +134744,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132134,11 +134789,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132177,11 +134834,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132220,11 +134879,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132263,11 +134924,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132306,11 +134969,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132349,11 +135014,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132392,11 +135059,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132435,11 +135104,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132478,11 +135149,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132521,11 +135194,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132564,11 +135239,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132607,11 +135284,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132650,11 +135329,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132693,11 +135374,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132736,11 +135419,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132779,11 +135464,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132822,11 +135509,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132865,11 +135554,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132908,11 +135599,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132951,11 +135644,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -132994,11 +135689,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133037,11 +135734,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133080,11 +135779,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133123,11 +135824,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133166,11 +135869,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133209,11 +135914,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133252,11 +135959,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133295,11 +136004,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133338,11 +136049,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133381,11 +136094,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133424,11 +136139,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133467,11 +136184,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133510,11 +136229,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133553,11 +136274,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133596,11 +136319,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133639,11 +136364,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133682,11 +136409,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133725,11 +136454,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133768,11 +136499,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133811,11 +136544,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133854,11 +136589,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133897,11 +136634,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133940,11 +136679,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -133983,11 +136724,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134026,11 +136769,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134069,11 +136814,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134112,11 +136859,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134155,11 +136904,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134198,11 +136949,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134241,11 +136994,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134284,11 +137039,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134327,11 +137084,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134370,11 +137129,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134413,11 +137174,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134456,11 +137219,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134499,11 +137264,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134542,11 +137309,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134585,11 +137354,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134628,11 +137399,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134671,11 +137444,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134714,11 +137489,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134757,11 +137534,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134800,11 +137579,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134843,11 +137624,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134886,11 +137669,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134929,11 +137714,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -134972,11 +137759,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135015,11 +137804,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135058,11 +137849,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135101,11 +137894,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135144,11 +137939,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135187,11 +137984,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135230,11 +138029,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135273,11 +138074,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135316,11 +138119,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135359,11 +138164,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135402,11 +138209,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135445,11 +138254,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135488,11 +138299,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135531,11 +138344,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135574,11 +138389,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135617,11 +138434,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135660,11 +138479,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135703,11 +138524,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135746,11 +138569,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135789,11 +138614,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135832,11 +138659,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135875,11 +138704,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135918,11 +138749,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -135961,11 +138794,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136004,11 +138839,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136047,11 +138884,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136090,11 +138929,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136133,11 +138974,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136176,11 +139019,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136219,11 +139064,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136262,11 +139109,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136305,11 +139154,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136348,11 +139199,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136391,11 +139244,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136434,11 +139289,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136477,11 +139334,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136520,11 +139379,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136563,11 +139424,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136606,11 +139469,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136649,11 +139514,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136692,11 +139559,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136735,11 +139604,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136778,11 +139649,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136821,11 +139694,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136864,11 +139739,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136907,11 +139784,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136950,11 +139829,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -136993,11 +139874,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137036,11 +139919,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137079,11 +139964,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137122,11 +140009,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137165,11 +140054,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137208,11 +140099,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137251,11 +140144,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137294,11 +140189,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137337,11 +140234,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137380,11 +140279,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137423,11 +140324,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137466,11 +140369,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137509,11 +140414,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137552,11 +140459,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137595,11 +140504,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137638,11 +140549,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137681,11 +140594,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137724,11 +140639,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137767,11 +140684,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137810,11 +140729,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137853,11 +140774,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137896,11 +140819,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137939,11 +140864,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -137982,11 +140909,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138025,11 +140954,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138068,11 +140999,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138111,11 +141044,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138154,11 +141089,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138197,11 +141134,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138240,11 +141179,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138283,11 +141224,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138326,11 +141269,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138369,11 +141314,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138412,11 +141359,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138455,11 +141404,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138498,11 +141449,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138541,11 +141494,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138584,11 +141539,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138627,11 +141584,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138670,11 +141629,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138713,11 +141674,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138756,11 +141719,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138799,11 +141764,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138842,11 +141809,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138885,11 +141854,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138928,11 +141899,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -138971,11 +141944,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139014,11 +141989,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139057,11 +142034,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139100,11 +142079,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139143,11 +142124,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139186,11 +142169,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139229,11 +142214,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139272,11 +142259,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139315,11 +142304,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139358,11 +142349,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139401,11 +142394,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139444,11 +142439,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139487,11 +142484,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139530,11 +142529,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139573,11 +142574,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139616,11 +142619,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139659,11 +142664,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139702,11 +142709,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139745,11 +142754,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139788,11 +142799,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139831,11 +142844,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139874,11 +142889,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139917,11 +142934,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -139960,11 +142979,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140003,11 +143024,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140046,11 +143069,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140089,11 +143114,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140132,11 +143159,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140175,11 +143204,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140218,11 +143249,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140261,11 +143294,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140304,11 +143339,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140347,11 +143384,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140390,11 +143429,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140433,11 +143474,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140476,11 +143519,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140519,11 +143564,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140562,11 +143609,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140605,11 +143654,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140648,11 +143699,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140691,11 +143744,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140734,11 +143789,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140777,11 +143834,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140820,11 +143879,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140863,11 +143924,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140906,11 +143969,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140949,11 +144014,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -140992,11 +144059,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141035,11 +144104,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141078,11 +144149,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141121,11 +144194,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141164,11 +144239,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141207,11 +144284,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141250,11 +144329,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141293,11 +144374,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141336,11 +144419,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141379,11 +144464,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141422,11 +144509,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141465,11 +144554,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141508,11 +144599,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141551,11 +144644,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141594,11 +144689,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141637,11 +144734,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141680,11 +144779,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141723,11 +144824,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141766,11 +144869,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141809,11 +144914,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141852,11 +144959,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141895,11 +145004,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141938,11 +145049,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -141981,11 +145094,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142024,11 +145139,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142067,11 +145184,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142110,11 +145229,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142153,11 +145274,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142196,11 +145319,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142239,11 +145364,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142282,11 +145409,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142325,11 +145454,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142368,11 +145499,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142411,11 +145544,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142454,11 +145589,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142497,11 +145634,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142540,11 +145679,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142583,11 +145724,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142626,11 +145769,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142669,11 +145814,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142712,11 +145859,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142755,11 +145904,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142798,11 +145949,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142841,11 +145994,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142884,11 +146039,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142927,11 +146084,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -142970,11 +146129,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143013,11 +146174,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143056,11 +146219,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143099,11 +146264,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143142,11 +146309,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143185,11 +146354,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143228,11 +146399,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143271,11 +146444,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143314,11 +146489,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143357,11 +146534,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143400,11 +146579,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143443,11 +146624,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143486,11 +146669,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143529,11 +146714,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143572,11 +146759,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143615,11 +146804,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143658,11 +146849,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143701,11 +146894,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143744,11 +146939,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143787,11 +146984,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143830,11 +147029,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143873,11 +147074,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143916,11 +147119,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -143959,11 +147164,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144002,11 +147209,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144045,11 +147254,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144088,11 +147299,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144131,11 +147344,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144174,11 +147389,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144217,11 +147434,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144260,11 +147479,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144303,11 +147524,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144346,11 +147569,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144389,11 +147614,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144432,11 +147659,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144475,11 +147704,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144518,11 +147749,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144561,11 +147794,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144604,11 +147839,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144647,11 +147884,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144690,11 +147929,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144733,11 +147974,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144776,11 +148019,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144819,11 +148064,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144862,11 +148109,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144905,11 +148154,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144948,11 +148199,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -144991,11 +148244,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145034,11 +148289,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145077,11 +148334,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145120,11 +148379,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145163,11 +148424,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145206,11 +148469,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145249,11 +148514,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145292,11 +148559,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145335,11 +148604,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145378,11 +148649,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145421,11 +148694,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145464,11 +148739,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145507,11 +148784,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145550,11 +148829,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145593,11 +148874,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145636,11 +148919,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145679,11 +148964,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145722,11 +149009,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145765,11 +149054,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145808,11 +149099,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145851,11 +149144,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145894,11 +149189,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145937,11 +149234,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -145980,11 +149279,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
@@ -146023,11 +149324,13 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,2
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml,0
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml,0
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml,5
diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json
index bb0bcd163d..0934e11829 100644
--- a/docs/mitre-map/detections.json
+++ b/docs/mitre-map/detections.json
@@ -208100,9 +208100,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208145,9 +208145,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208188,9 +208188,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208233,9 +208233,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208276,9 +208276,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208321,9 +208321,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208364,9 +208364,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208409,9 +208409,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208452,9 +208452,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208497,9 +208497,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208540,9 +208540,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208585,9 +208585,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208628,9 +208628,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208673,9 +208673,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208716,9 +208716,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208761,9 +208761,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208804,9 +208804,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208849,9 +208849,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208892,9 +208892,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208937,9 +208937,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -208980,9 +208980,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209025,9 +209025,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209068,9 +209068,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209113,9 +209113,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209156,9 +209156,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209201,9 +209201,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209244,9 +209244,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209289,9 +209289,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209332,9 +209332,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209377,9 +209377,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209420,9 +209420,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209465,9 +209465,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209508,9 +209508,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209553,9 +209553,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209596,9 +209596,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209641,9 +209641,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209684,9 +209684,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209729,9 +209729,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209772,9 +209772,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209817,9 +209817,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209860,9 +209860,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209905,9 +209905,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -209948,9 +209948,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209993,9 +209993,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210036,9 +210036,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210081,9 +210081,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210124,9 +210124,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210169,9 +210169,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210212,9 +210212,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210257,9 +210257,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210300,9 +210300,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210345,9 +210345,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210388,9 +210388,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210433,9 +210433,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210476,9 +210476,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210521,9 +210521,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210564,9 +210564,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210609,9 +210609,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210652,9 +210652,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210697,9 +210697,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210740,9 +210740,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210785,9 +210785,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210828,9 +210828,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210873,9 +210873,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -210916,9 +210916,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210961,9 +210961,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211004,9 +211004,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211049,9 +211049,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211092,9 +211092,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211137,9 +211137,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211180,9 +211180,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211225,9 +211225,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211268,9 +211268,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211313,9 +211313,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211356,9 +211356,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211401,9 +211401,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211444,9 +211444,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211489,9 +211489,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211532,9 +211532,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211577,9 +211577,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211620,9 +211620,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211665,9 +211665,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211708,9 +211708,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211753,9 +211753,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211796,9 +211796,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211841,9 +211841,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211884,9 +211884,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211929,9 +211929,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -211972,9 +211972,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212017,9 +212017,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212060,9 +212060,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212105,9 +212105,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212148,9 +212148,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212193,9 +212193,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212236,9 +212236,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212281,9 +212281,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212324,9 +212324,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212369,9 +212369,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212412,9 +212412,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212457,9 +212457,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212500,9 +212500,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212545,9 +212545,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212588,9 +212588,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212633,9 +212633,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212676,9 +212676,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212721,9 +212721,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212764,9 +212764,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212809,9 +212809,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212852,9 +212852,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212897,9 +212897,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -212940,9 +212940,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212985,9 +212985,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213028,9 +213028,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213073,9 +213073,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213116,9 +213116,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213161,9 +213161,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213204,9 +213204,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213249,9 +213249,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213292,9 +213292,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213337,9 +213337,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213380,9 +213380,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213425,9 +213425,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213468,9 +213468,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213513,9 +213513,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213556,9 +213556,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213601,9 +213601,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213644,9 +213644,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213689,9 +213689,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213732,9 +213732,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213777,9 +213777,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213820,9 +213820,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213865,9 +213865,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213908,9 +213908,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213953,9 +213953,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -213996,9 +213996,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214041,9 +214041,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214084,9 +214084,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214129,9 +214129,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214172,9 +214172,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214217,9 +214217,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214260,9 +214260,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214305,9 +214305,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214348,9 +214348,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214393,9 +214393,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214436,9 +214436,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214481,9 +214481,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214524,9 +214524,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214569,9 +214569,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214612,9 +214612,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214657,9 +214657,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214700,9 +214700,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214745,9 +214745,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214788,9 +214788,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214833,9 +214833,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214876,9 +214876,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214921,9 +214921,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -214964,9 +214964,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215009,9 +215009,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215052,9 +215052,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215097,9 +215097,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215140,9 +215140,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215185,9 +215185,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215228,9 +215228,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215273,9 +215273,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215316,9 +215316,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215361,9 +215361,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215404,9 +215404,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215449,9 +215449,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215492,9 +215492,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215537,9 +215537,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215580,9 +215580,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215625,9 +215625,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215668,9 +215668,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215713,9 +215713,97 @@
         },
         {
             "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": -1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215756,9 +215844,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215801,9 +215889,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215844,9 +215932,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215889,9 +215977,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -215932,9 +216020,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215977,9 +216065,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216020,9 +216108,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216065,9 +216153,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216108,9 +216196,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216153,9 +216241,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216196,9 +216284,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216241,9 +216329,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216284,9 +216372,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216329,9 +216417,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216372,9 +216460,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216417,9 +216505,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216460,9 +216548,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216505,9 +216593,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216548,9 +216636,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216593,9 +216681,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216636,9 +216724,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216681,9 +216769,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216724,9 +216812,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216769,9 +216857,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216812,9 +216900,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216857,9 +216945,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216900,9 +216988,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216945,9 +217033,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -216988,9 +217076,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217033,9 +217121,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217076,9 +217164,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217121,9 +217209,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217164,9 +217252,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217209,9 +217297,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217252,9 +217340,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217297,9 +217385,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217340,9 +217428,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217385,9 +217473,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217428,9 +217516,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217473,9 +217561,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217516,9 +217604,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217561,9 +217649,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217604,9 +217692,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217649,9 +217737,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217692,9 +217780,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217737,9 +217825,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217780,9 +217868,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217825,9 +217913,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217868,9 +217956,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217913,9 +218001,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -217956,9 +218044,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218001,9 +218089,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218044,9 +218132,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218089,9 +218177,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218132,9 +218220,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218177,9 +218265,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218220,9 +218308,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218265,9 +218353,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218308,9 +218396,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218353,9 +218441,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218396,9 +218484,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218441,9 +218529,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218484,9 +218572,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218529,9 +218617,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218572,9 +218660,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218617,9 +218705,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218660,9 +218748,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218705,9 +218793,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218748,9 +218836,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218793,9 +218881,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218836,9 +218924,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218881,9 +218969,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -218924,9 +219012,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218969,9 +219057,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219012,9 +219100,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219057,9 +219145,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219100,9 +219188,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219145,9 +219233,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219188,9 +219276,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219233,9 +219321,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219276,9 +219364,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219321,9 +219409,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219364,9 +219452,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219409,9 +219497,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219452,9 +219540,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219497,9 +219585,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219540,9 +219628,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219585,9 +219673,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219628,9 +219716,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219673,9 +219761,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219716,9 +219804,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219761,9 +219849,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219804,9 +219892,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219849,9 +219937,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219892,9 +219980,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219937,9 +220025,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -219980,9 +220068,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220025,9 +220113,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220068,9 +220156,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220113,9 +220201,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220156,9 +220244,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220201,9 +220289,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220244,9 +220332,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220289,9 +220377,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220332,9 +220420,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220377,9 +220465,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220420,9 +220508,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220465,9 +220553,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220508,9 +220596,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220553,9 +220641,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220596,9 +220684,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220641,9 +220729,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220684,9 +220772,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220729,9 +220817,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220772,9 +220860,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220817,9 +220905,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220860,9 +220948,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220905,9 +220993,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -220948,9 +221036,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220993,9 +221081,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221036,9 +221124,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221081,9 +221169,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221124,9 +221212,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221169,9 +221257,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221212,9 +221300,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221257,9 +221345,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221300,9 +221388,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221345,9 +221433,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221388,9 +221476,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221433,9 +221521,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221476,9 +221564,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221521,9 +221609,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221564,9 +221652,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221609,9 +221697,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221652,9 +221740,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221697,9 +221785,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221740,9 +221828,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221785,9 +221873,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221828,9 +221916,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221873,9 +221961,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -221916,9 +222004,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221961,9 +222049,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222004,9 +222092,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222049,9 +222137,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222092,9 +222180,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222137,9 +222225,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222180,9 +222268,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222225,9 +222313,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222268,9 +222356,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222313,9 +222401,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222356,9 +222444,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222401,9 +222489,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222444,9 +222532,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222489,9 +222577,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222532,9 +222620,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222577,9 +222665,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222620,9 +222708,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222665,9 +222753,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222708,9 +222796,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222753,9 +222841,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222796,9 +222884,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222841,9 +222929,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222884,9 +222972,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222929,9 +223017,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -222972,9 +223060,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223017,9 +223105,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223060,9 +223148,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223105,9 +223193,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223148,9 +223236,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223193,9 +223281,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223236,9 +223324,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223281,9 +223369,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223324,9 +223412,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223369,9 +223457,97 @@
         },
         {
             "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": -1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223412,9 +223588,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223457,9 +223633,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223500,9 +223676,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223545,9 +223721,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223588,9 +223764,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223633,9 +223809,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223676,9 +223852,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223721,9 +223897,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223764,9 +223940,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223809,9 +223985,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223852,9 +224028,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223897,9 +224073,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -223940,9 +224116,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223985,9 +224161,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224028,9 +224204,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224073,9 +224249,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224116,9 +224292,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224161,9 +224337,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224204,9 +224380,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224249,9 +224425,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224292,9 +224468,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224337,9 +224513,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224380,9 +224556,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224425,9 +224601,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224468,9 +224644,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224513,9 +224689,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224556,9 +224732,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224601,9 +224777,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224644,9 +224820,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224689,9 +224865,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224732,9 +224908,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224777,9 +224953,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224820,9 +224996,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224865,9 +225041,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224908,9 +225084,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224953,9 +225129,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -224996,9 +225172,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225041,9 +225217,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225084,9 +225260,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225129,9 +225305,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225172,9 +225348,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225217,9 +225393,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225260,9 +225436,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225305,9 +225481,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225348,9 +225524,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225393,9 +225569,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225436,9 +225612,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225481,9 +225657,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225524,9 +225700,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225569,9 +225745,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225612,9 +225788,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225657,9 +225833,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225700,9 +225876,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225745,9 +225921,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225788,9 +225964,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225833,9 +226009,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225876,9 +226052,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225921,9 +226097,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -225964,9 +226140,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226009,9 +226185,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226052,9 +226228,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226097,9 +226273,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226140,9 +226316,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226185,9 +226361,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226228,9 +226404,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226273,9 +226449,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226316,9 +226492,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226361,9 +226537,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226404,9 +226580,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226449,9 +226625,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226492,9 +226668,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226537,9 +226713,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226580,9 +226756,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226625,9 +226801,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226668,9 +226844,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226713,9 +226889,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226756,9 +226932,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226801,9 +226977,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226844,9 +227020,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226889,9 +227065,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -226932,9 +227108,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226977,9 +227153,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227020,9 +227196,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227065,9 +227241,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227108,9 +227284,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227153,9 +227329,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227196,9 +227372,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227241,9 +227417,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227284,9 +227460,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227329,9 +227505,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227372,9 +227548,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227417,9 +227593,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227460,9 +227636,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227505,9 +227681,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227548,9 +227724,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227593,9 +227769,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227636,9 +227812,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227681,9 +227857,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227724,9 +227900,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227769,9 +227945,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227812,9 +227988,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227857,9 +228033,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227900,9 +228076,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227945,9 +228121,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -227988,9 +228164,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228033,9 +228209,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228076,9 +228252,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228121,9 +228297,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228164,9 +228340,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228209,9 +228385,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228252,9 +228428,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228297,9 +228473,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228340,9 +228516,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228385,9 +228561,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228428,9 +228604,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228473,9 +228649,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228516,9 +228692,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228561,9 +228737,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228604,9 +228780,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228649,9 +228825,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228692,9 +228868,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228737,9 +228913,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228780,9 +228956,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228825,9 +229001,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228868,9 +229044,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228913,9 +229089,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -228956,9 +229132,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229001,9 +229177,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229044,9 +229220,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229089,9 +229265,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229132,9 +229308,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229177,9 +229353,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229220,9 +229396,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229265,9 +229441,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229308,9 +229484,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229353,9 +229529,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229396,9 +229572,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229441,9 +229617,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229484,9 +229660,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229529,9 +229705,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229572,9 +229748,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229617,9 +229793,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229660,9 +229836,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229705,9 +229881,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229748,9 +229924,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229793,9 +229969,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229836,9 +230012,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229881,9 +230057,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -229924,9 +230100,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229969,9 +230145,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230012,9 +230188,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230057,9 +230233,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230100,9 +230276,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230145,9 +230321,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230188,9 +230364,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230233,9 +230409,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230276,9 +230452,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230321,9 +230497,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230364,9 +230540,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230409,9 +230585,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230452,9 +230628,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230497,9 +230673,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230540,9 +230716,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230585,9 +230761,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230628,9 +230804,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230673,9 +230849,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230716,9 +230892,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230761,9 +230937,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230804,9 +230980,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230849,9 +231025,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230892,9 +231068,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230937,9 +231113,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -230980,9 +231156,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231025,9 +231201,97 @@
         },
         {
             "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": -1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231068,9 +231332,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231113,9 +231377,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231156,9 +231420,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231201,9 +231465,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231244,9 +231508,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231289,9 +231553,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231332,9 +231596,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231377,9 +231641,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231420,9 +231684,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231465,9 +231729,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231508,9 +231772,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231553,9 +231817,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231596,9 +231860,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231641,9 +231905,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231684,9 +231948,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231729,9 +231993,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231772,9 +232036,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231817,9 +232081,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231860,9 +232124,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231905,9 +232169,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -231948,9 +232212,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231993,9 +232257,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232036,9 +232300,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232081,9 +232345,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232124,9 +232388,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232169,9 +232433,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232212,9 +232476,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232257,9 +232521,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232300,9 +232564,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232345,9 +232609,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232388,9 +232652,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232433,9 +232697,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232476,9 +232740,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232521,9 +232785,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232564,9 +232828,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232609,9 +232873,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232652,9 +232916,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232697,9 +232961,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232740,9 +233004,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232785,9 +233049,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232828,9 +233092,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232873,9 +233137,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -232916,9 +233180,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232961,9 +233225,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233004,9 +233268,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233049,9 +233313,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233092,9 +233356,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233137,9 +233401,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233180,9 +233444,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233225,9 +233489,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233268,9 +233532,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233313,9 +233577,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233356,9 +233620,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233401,9 +233665,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233444,9 +233708,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233489,9 +233753,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233532,9 +233796,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233577,9 +233841,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233620,9 +233884,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233665,9 +233929,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233708,9 +233972,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233753,9 +234017,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233796,9 +234060,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233841,9 +234105,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233884,9 +234148,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233929,9 +234193,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -233972,9 +234236,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234017,9 +234281,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234060,9 +234324,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234105,9 +234369,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234148,9 +234412,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234193,9 +234457,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234236,9 +234500,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234281,9 +234545,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234324,9 +234588,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234369,9 +234633,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234412,9 +234676,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234457,9 +234721,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234500,9 +234764,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234545,9 +234809,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234588,9 +234852,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234633,9 +234897,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234676,9 +234940,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234721,9 +234985,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234764,9 +235028,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234809,9 +235073,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234852,9 +235116,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234897,9 +235161,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -234940,9 +235204,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234985,9 +235249,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235028,9 +235292,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235073,9 +235337,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235116,9 +235380,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235161,9 +235425,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235204,9 +235468,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235249,9 +235513,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235292,9 +235556,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235337,9 +235601,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235380,9 +235644,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235425,9 +235689,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235468,9 +235732,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235513,9 +235777,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235556,9 +235820,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235601,9 +235865,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235644,9 +235908,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235689,9 +235953,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235732,9 +235996,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235777,9 +236041,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235820,9 +236084,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235865,9 +236129,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235908,9 +236172,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235953,9 +236217,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -235996,9 +236260,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236041,9 +236305,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236084,9 +236348,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236129,9 +236393,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236172,9 +236436,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236217,9 +236481,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236260,9 +236524,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236305,9 +236569,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236348,9 +236612,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236393,9 +236657,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236436,9 +236700,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236481,9 +236745,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236524,9 +236788,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236569,9 +236833,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236612,9 +236876,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236657,9 +236921,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236700,9 +236964,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236745,9 +237009,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236788,9 +237052,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236833,9 +237097,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236876,9 +237140,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236921,9 +237185,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -236964,9 +237228,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237009,9 +237273,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237052,9 +237316,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237097,9 +237361,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237140,9 +237404,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237185,9 +237449,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237228,9 +237492,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237273,9 +237537,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237316,9 +237580,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237361,9 +237625,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237404,9 +237668,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237449,9 +237713,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237492,9 +237756,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237537,9 +237801,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237580,9 +237844,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237625,9 +237889,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237668,9 +237932,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237713,9 +237977,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237756,9 +238020,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237801,9 +238065,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237844,9 +238108,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237889,9 +238153,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -237932,9 +238196,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237977,9 +238241,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238020,9 +238284,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238065,9 +238329,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238108,9 +238372,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238153,9 +238417,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238196,9 +238460,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238241,9 +238505,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238284,9 +238548,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238329,9 +238593,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238372,9 +238636,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238417,9 +238681,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238460,9 +238724,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238505,9 +238769,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238548,9 +238812,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238593,9 +238857,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238636,9 +238900,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238681,9 +238945,97 @@
         },
         {
             "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+        },
+        {
+            "techniqueID": "T1583.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1170",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1584.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.010",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
+        },
+        {
+            "techniqueID": "T1078.002",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
+        },
+        {
+            "techniqueID": "T1088",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1548.002",
+            "score": -1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1099",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1071.004",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
+        },
+        {
+            "techniqueID": "T1007",
+            "score": 7,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1070.006",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1070.001",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
+        },
+        {
+            "techniqueID": "T1117",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
+        },
+        {
+            "techniqueID": "T1090.002",
+            "score": 9,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.005",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -238724,9 +239076,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -238769,361 +239121,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
-        },
-        {
-            "techniqueID": "T1583.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1170",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1584.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.010",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml"
-        },
-        {
-            "techniqueID": "T1078.002",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml"
-        },
-        {
-            "techniqueID": "T1088",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1590.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1548.002",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
-        },
-        {
-            "techniqueID": "T1099",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1071.004",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/dns_record_changed.yml"
-        },
-        {
-            "techniqueID": "T1007",
-            "score": 7,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1070.006",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1070.001",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml"
-        },
-        {
-            "techniqueID": "T1117",
-            "score": 8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___first_time_seen_cmd_line.yml"
-        },
-        {
-            "techniqueID": "T1090.002",
-            "score": 9,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239164,9 +239164,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239209,9 +239209,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239252,9 +239252,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239297,9 +239297,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239340,9 +239340,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239385,9 +239385,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239428,9 +239428,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239473,9 +239473,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239516,9 +239516,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239561,9 +239561,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239604,9 +239604,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239649,9 +239649,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239692,9 +239692,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239737,9 +239737,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239780,9 +239780,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239825,9 +239825,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239868,9 +239868,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -239913,9 +239913,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -239956,9 +239956,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -240001,9 +240001,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -240044,9 +240044,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -240089,9 +240089,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -240132,9 +240132,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -240177,9 +240177,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -240220,9 +240220,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -240265,9 +240265,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -240308,9 +240308,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 4,
+            "score": -1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml"
         },
         {
             "techniqueID": "T1099",
@@ -240353,9 +240353,9 @@
         },
         {
             "techniqueID": "T1218.005",
-            "score": 3,
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml"
         },
         {
             "techniqueID": "T1583.006",
@@ -270123,9 +270123,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270225,9 +270225,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270327,9 +270327,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270429,9 +270429,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270531,9 +270531,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270633,9 +270633,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270735,9 +270735,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270837,9 +270837,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270939,9 +270939,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271041,9 +271041,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271143,9 +271143,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271245,9 +271245,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271347,9 +271347,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271449,9 +271449,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271551,9 +271551,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271653,9 +271653,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271755,9 +271755,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271857,9 +271857,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271959,9 +271959,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272061,9 +272061,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272163,9 +272163,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272265,9 +272265,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272367,9 +272367,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272469,9 +272469,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272571,9 +272571,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272673,9 +272673,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272775,9 +272775,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272877,9 +272877,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272979,9 +272979,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273081,9 +273081,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273183,9 +273183,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273285,9 +273285,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273387,9 +273387,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273489,9 +273489,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273591,9 +273591,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273693,9 +273693,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273795,9 +273795,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273897,9 +273897,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273999,9 +273999,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274101,9 +274101,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274203,9 +274203,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274305,9 +274305,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274407,9 +274407,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274509,9 +274509,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274611,9 +274611,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274713,9 +274713,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274815,9 +274815,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274917,9 +274917,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275019,9 +275019,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275121,9 +275121,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275223,9 +275223,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275325,9 +275325,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275427,9 +275427,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275529,9 +275529,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275631,9 +275631,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275733,9 +275733,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275835,9 +275835,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275937,9 +275937,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276039,9 +276039,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276141,9 +276141,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276243,9 +276243,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276345,9 +276345,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276447,9 +276447,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276549,9 +276549,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276651,9 +276651,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276753,9 +276753,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276855,9 +276855,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276957,9 +276957,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277059,9 +277059,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277161,9 +277161,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277263,9 +277263,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277365,9 +277365,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277467,9 +277467,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277569,9 +277569,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277671,9 +277671,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277773,9 +277773,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277875,9 +277875,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277977,9 +277977,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278079,9 +278079,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278181,9 +278181,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278283,9 +278283,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278385,9 +278385,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278487,9 +278487,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278589,9 +278589,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278691,9 +278691,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278793,9 +278793,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278895,9 +278895,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278997,9 +278997,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279099,9 +279099,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279201,9 +279201,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279303,9 +279303,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279405,9 +279405,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279507,9 +279507,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279609,9 +279609,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279711,9 +279711,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279813,9 +279813,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279915,9 +279915,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280017,9 +280017,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280119,9 +280119,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280221,9 +280221,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280323,9 +280323,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280425,9 +280425,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280527,9 +280527,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280629,9 +280629,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280731,9 +280731,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280833,9 +280833,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280935,9 +280935,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281037,9 +281037,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281139,9 +281139,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281241,9 +281241,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281343,9 +281343,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281445,9 +281445,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281547,9 +281547,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281649,9 +281649,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281751,9 +281751,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281853,9 +281853,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281955,9 +281955,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282057,9 +282057,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282159,9 +282159,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282261,9 +282261,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282363,9 +282363,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282465,9 +282465,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282567,9 +282567,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282669,9 +282669,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282771,9 +282771,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282873,9 +282873,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282975,9 +282975,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283077,9 +283077,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283179,9 +283179,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283281,9 +283281,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283383,9 +283383,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283485,9 +283485,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283587,9 +283587,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283689,9 +283689,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283791,9 +283791,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283893,9 +283893,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283995,9 +283995,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284097,9 +284097,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284199,9 +284199,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284301,9 +284301,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284403,9 +284403,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284505,9 +284505,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284607,9 +284607,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284709,9 +284709,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284811,9 +284811,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284913,9 +284913,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285015,9 +285015,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285117,9 +285117,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285219,9 +285219,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285321,9 +285321,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285423,9 +285423,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285525,9 +285525,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285627,9 +285627,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285729,9 +285729,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285831,9 +285831,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285933,9 +285933,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286035,9 +286035,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286137,9 +286137,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286239,9 +286239,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286341,9 +286341,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286443,9 +286443,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286545,9 +286545,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286647,9 +286647,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286749,9 +286749,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286851,9 +286851,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286953,9 +286953,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287055,9 +287055,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287157,9 +287157,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287259,9 +287259,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287361,9 +287361,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287463,9 +287463,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287565,9 +287565,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287667,9 +287667,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287769,9 +287769,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287871,9 +287871,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287973,9 +287973,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288075,9 +288075,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288177,9 +288177,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288279,9 +288279,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288381,9 +288381,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288483,9 +288483,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288585,9 +288585,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288687,9 +288687,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288789,9 +288789,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288891,9 +288891,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288993,9 +288993,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289095,9 +289095,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289197,9 +289197,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289299,9 +289299,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289401,9 +289401,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289503,9 +289503,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289605,9 +289605,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289707,9 +289707,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289809,9 +289809,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289911,9 +289911,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290013,9 +290013,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290115,9 +290115,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290217,9 +290217,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290319,9 +290319,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290421,9 +290421,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290523,9 +290523,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290625,9 +290625,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290727,9 +290727,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290829,9 +290829,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290931,9 +290931,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291033,9 +291033,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291135,9 +291135,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291237,9 +291237,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291339,9 +291339,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291441,9 +291441,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291543,9 +291543,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291645,9 +291645,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291747,9 +291747,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291849,9 +291849,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291951,9 +291951,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292053,9 +292053,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292155,9 +292155,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292257,9 +292257,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292359,9 +292359,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292461,9 +292461,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292563,9 +292563,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292665,9 +292665,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292767,9 +292767,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292869,9 +292869,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292971,9 +292971,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293073,9 +293073,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293175,9 +293175,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293277,9 +293277,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293379,9 +293379,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293481,9 +293481,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293583,9 +293583,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293685,9 +293685,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293787,9 +293787,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293889,9 +293889,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293991,9 +293991,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294093,9 +294093,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294195,9 +294195,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294297,9 +294297,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294399,9 +294399,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294501,9 +294501,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294603,9 +294603,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294705,9 +294705,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294807,9 +294807,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294909,9 +294909,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295011,9 +295011,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295113,9 +295113,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295215,9 +295215,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295317,9 +295317,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295419,9 +295419,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295521,9 +295521,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295623,9 +295623,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295725,9 +295725,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295827,9 +295827,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295929,9 +295929,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296031,9 +296031,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296133,9 +296133,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296235,9 +296235,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296337,9 +296337,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296439,9 +296439,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296541,9 +296541,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296643,9 +296643,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296745,9 +296745,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296847,9 +296847,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296949,9 +296949,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297051,9 +297051,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297153,9 +297153,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297255,9 +297255,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297357,9 +297357,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297459,9 +297459,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297561,9 +297561,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297663,9 +297663,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297765,9 +297765,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297867,9 +297867,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297969,9 +297969,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298071,9 +298071,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298173,9 +298173,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298275,9 +298275,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298377,9 +298377,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298479,9 +298479,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298581,9 +298581,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298683,9 +298683,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298785,9 +298785,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298887,9 +298887,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298989,9 +298989,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299091,9 +299091,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299193,9 +299193,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299295,9 +299295,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299397,9 +299397,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299499,9 +299499,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299601,9 +299601,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299703,9 +299703,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299805,9 +299805,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299907,9 +299907,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300009,9 +300009,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300111,9 +300111,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300213,9 +300213,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300315,9 +300315,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300417,9 +300417,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300519,9 +300519,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300621,9 +300621,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300723,9 +300723,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300825,9 +300825,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300927,9 +300927,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301029,9 +301029,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301131,9 +301131,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301233,9 +301233,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301335,9 +301335,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301437,9 +301437,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301539,9 +301539,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301641,9 +301641,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301743,9 +301743,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301845,9 +301845,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301947,9 +301947,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302049,9 +302049,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302151,9 +302151,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302253,9 +302253,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302355,9 +302355,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302457,9 +302457,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302559,9 +302559,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302661,9 +302661,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302763,9 +302763,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302865,9 +302865,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302967,9 +302967,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303069,9 +303069,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303171,9 +303171,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303273,9 +303273,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303375,9 +303375,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303477,9 +303477,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303579,9 +303579,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303681,9 +303681,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303783,9 +303783,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303885,9 +303885,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303987,9 +303987,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304089,9 +304089,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304191,9 +304191,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304293,9 +304293,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304395,9 +304395,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304497,9 +304497,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304599,9 +304599,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304701,9 +304701,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304803,9 +304803,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -304905,9 +304905,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305007,9 +305007,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305109,9 +305109,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305211,9 +305211,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305313,9 +305313,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305415,9 +305415,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305517,9 +305517,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305619,9 +305619,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305721,9 +305721,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305823,9 +305823,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -305925,9 +305925,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306027,9 +306027,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306129,9 +306129,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306231,9 +306231,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306333,9 +306333,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306435,9 +306435,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306537,9 +306537,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306639,9 +306639,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306741,9 +306741,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306843,9 +306843,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -306945,9 +306945,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -307047,9 +307047,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -307149,9 +307149,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -307251,9 +307251,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -307353,9 +307353,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
@@ -307455,9 +307455,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 2,
+            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml"
         },
         {
             "techniqueID": "T1071",
diff --git a/docs/stories.md b/docs/stories.md
index aa39f28fe9..7ea62dd3c8 100644
--- a/docs/stories.md
+++ b/docs/stories.md
@@ -530,6 +530,7 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 | T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
+| T1537 | Transfer Data to Cloud Account | Exfiltration |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
@@ -615,6 +616,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](detections.md#credential-extraction-via-get-addbaccount-module-present-in-powersploit-and-dsinternals)
 
+* [Detect Copy of ShadowCopy with Script Block Logging](detections.md#detect-copy-of-shadowcopy-with-script-block-logging)
+
 * [Detect Credential Dumping through LSASS access](detections.md#detect-credential-dumping-through-lsass-access)
 
 * [Detect Dump LSASS Memory using comsvcs](detections.md#detect-dump-lsass-memory-using-comsvcs)
@@ -633,6 +636,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [Ntdsutil Export NTDS](detections.md#ntdsutil-export-ntds)
 
+* [SAM Database File Access Attempt](detections.md#sam-database-file-access-attempt)
+
 * [SecretDumps Offline NTDS Dumping Tool](detections.md#secretdumps-offline-ntds-dumping-tool)
 
 * [Set Default PowerShell Execution Policy To Unrestricted or Bypass](detections.md#set-default-powershell-execution-policy-to-unrestricted-or-bypass)
@@ -735,7 +740,7 @@ The stealing of data by an adversary.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1041](https://attack.mitre.org/techniques/T1041/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1048.003](https://attack.mitre.org/techniques/T1048.003/), [T1114](https://attack.mitre.org/techniques/T1114/), [T1114.001](https://attack.mitre.org/techniques/T1114.001/), [T1114.003](https://attack.mitre.org/techniques/T1114.003/)
+- **ATT&CK**: [T1041](https://attack.mitre.org/techniques/T1041/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1048.003](https://attack.mitre.org/techniques/T1048.003/), [T1114](https://attack.mitre.org/techniques/T1114/), [T1114.001](https://attack.mitre.org/techniques/T1114.001/), [T1114.003](https://attack.mitre.org/techniques/T1114.003/), [T1537](https://attack.mitre.org/techniques/T1537/)
 - **Last Updated**: 2020-10-21
 
 <details>
@@ -747,6 +752,8 @@ The stealing of data by an adversary.
 
 * [Detect SNICat SNI Exfiltration](detections.md#detect-snicat-sni-exfiltration)
 
+* [Detect shared ec2 snapshot](detections.md#detect-shared-ec2-snapshot)
+
 * [Excessive Usage of NSLOOKUP App](detections.md#excessive-usage-of-nslookup-app)
 
 * [Mailsniper Invoke functions](detections.md#mailsniper-invoke-functions)
@@ -772,6 +779,7 @@ The stealing of data by an adversary.
 | T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
+| T1537 | Transfer Data to Cloud Account | Exfiltration |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
@@ -1898,6 +1906,7 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 | T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
+| T1537 | Transfer Data to Cloud Account | Exfiltration |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
@@ -2564,14 +2573,24 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [Hiding Files And Directories With Attrib exe](detections.md#hiding-files-and-directories-with-attrib-exe)
 
+* [NET Profiler UAC bypass](detections.md#net-profiler-uac-bypass)
+
 * [SLUI RunAs Elevated](detections.md#slui-runas-elevated)
 
 * [SLUI Spawning a Process](detections.md#slui-spawning-a-process)
 
+* [Sdclt UAC Bypass](detections.md#sdclt-uac-bypass)
+
+* [SilentCleanup UAC Bypass](detections.md#silentcleanup-uac-bypass)
+
 * [Suspicious Reg exe Process](detections.md#suspicious-reg-exe-process)
 
 * [System Process Running from Unexpected Location](detections.md#system-process-running-from-unexpected-location)
 
+* [UAC Bypass MMC Load Unsigned Dll](detections.md#uac-bypass-mmc-load-unsigned-dll)
+
+* [WSReset UAC Bypass](detections.md#wsreset-uac-bypass)
+
 * [Windows DisableAntiSpyware Registry](detections.md#windows-disableantispyware-registry)
 
 
@@ -3917,7 +3936,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Change
-- **ATT&CK**: [T1078.004](https://attack.mitre.org/techniques/T1078.004/)
+- **ATT&CK**: [T1078.004](https://attack.mitre.org/techniques/T1078.004/), [T1537](https://attack.mitre.org/techniques/T1537/)
 - **Last Updated**: 2020-08-25
 
 <details>
@@ -3931,12 +3950,15 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 * [Cloud Instance Modified By Previously Unseen User](detections.md#cloud-instance-modified-by-previously-unseen-user)
 
+* [Detect shared ec2 snapshot](detections.md#detect-shared-ec2-snapshot)
+
 
 #### ATT&CK
 
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
+| T1537 | Transfer Data to Cloud Account | Exfiltration |
 
 #### Kill Chain Phase
 
@@ -4487,6 +4509,7 @@ Detect and investigate hosts in your environment that may be communicating with
 | T1095 | Non-Application Layer Protocol | Command And Control |
 | T1041 | Exfiltration Over C2 Channel | Exfiltration |
 | T1189 | Drive-by Compromise | Initial Access |
+| T1537 | Transfer Data to Cloud Account | Exfiltration |
 | T1114.001 | Local Email Collection | Collection |
 | T1114 | Email Collection | Collection |
 | T1114.003 | Email Forwarding Rule | Collection |
@@ -5206,7 +5229,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
-- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1027](https://attack.mitre.org/techniques/T1027/), [T1053](https://attack.mitre.org/techniques/T1053/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1059](https://attack.mitre.org/techniques/T1059/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1218.011](https://attack.mitre.org/techniques/T1218.011/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1566.001](https://attack.mitre.org/techniques/T1566.001/), [T1590.005](https://attack.mitre.org/techniques/T1590.005/)
+- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1027](https://attack.mitre.org/techniques/T1027/), [T1053](https://attack.mitre.org/techniques/T1053/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1059](https://attack.mitre.org/techniques/T1059/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1218.005](https://attack.mitre.org/techniques/T1218.005/), [T1218.011](https://attack.mitre.org/techniques/T1218.011/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1566.001](https://attack.mitre.org/techniques/T1566.001/), [T1590.005](https://attack.mitre.org/techniques/T1590.005/)
 - **Last Updated**: 2021-04-20
 
 <details>
@@ -5220,10 +5243,14 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Cobalt Strike Named Pipes](detections.md#cobalt-strike-named-pipes)
 
+* [Mshta spawning Rundll32 OR Regsvr32 Process](detections.md#mshta-spawning-rundll32-or-regsvr32-process)
+
 * [Office Application Spawn rundll32 process](detections.md#office-application-spawn-rundll32-process)
 
 * [Office Document Executing Macro Code](detections.md#office-document-executing-macro-code)
 
+* [Office Product Spawn CMD Process](detections.md#office-product-spawn-cmd-process)
+
 * [Powershell Remote Thread To Known Windows Process](detections.md#powershell-remote-thread-to-known-windows-process)
 
 * [Schedule Task with Rundll32 Command Trigger](detections.md#schedule-task-with-rundll32-command-trigger)
@@ -5248,6 +5275,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | T1087.002 | Domain Account | Discovery |
 | T1562.001 | Disable or Modify Tools | Defense Evasion |
 | T1055 | Process Injection | Defense Evasion, Privilege Escalation |
+| T1218.005 | Mshta | Defense Evasion |
 | T1566.001 | Spearphishing Attachment | Initial Access |
 | T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
 | T1218.011 | Rundll32 | Defense Evasion |
diff --git a/docs/stories.wiki b/docs/stories.wiki
index be14f3581a..2f1a4ccc6a 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -610,7 +610,7 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 * '''Last Updated''': 2018-06-01
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -676,6 +676,10 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 | Drive-by Compromise
 | Initial Access
 |-
+| T1537
+| Transfer Data to Cloud Account
+| Exfiltration
+|-
 | T1114.001
 | Local Email Collection
 | Collection
@@ -775,6 +779,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [[Documentation:ESSOC:detections:Detections#Credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals|Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_copy_of_shadowcopy_with_script_block_logging|Detect Copy of ShadowCopy with Script Block Logging]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_credential_dumping_through_lsass_access|Detect Credential Dumping through LSASS access]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_dump_lsass_memory_using_comsvcs|Detect Dump LSASS Memory using comsvcs]]
@@ -793,6 +799,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
 
+* [[Documentation:ESSOC:detections:Detections#Sam_database_file_access_attempt|SAM Database File Access Attempt]]
+
 * [[Documentation:ESSOC:detections:Detections#Secretdumps_offline_ntds_dumping_tool|SecretDumps Offline NTDS Dumping Tool]]
 
 * [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
@@ -971,7 +979,7 @@ The stealing of data by an adversary.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 * '''Last Updated''': 2020-10-21
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -983,6 +991,8 @@ The stealing of data by an adversary.
 
 * [[Documentation:ESSOC:detections:Detections#Detect_snicat_sni_exfiltration|Detect SNICat SNI Exfiltration]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_shared_ec2_snapshot|Detect shared ec2 snapshot]]
+
 * [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
 
 * [[Documentation:ESSOC:detections:Detections#Mailsniper_invoke_functions|Mailsniper Invoke functions]]
@@ -1029,6 +1039,10 @@ The stealing of data by an adversary.
 | Drive-by Compromise
 | Initial Access
 |-
+| T1537
+| Transfer Data to Cloud Account
+| Exfiltration
+|-
 | T1114.001
 | Local Email Collection
 | Collection
@@ -2540,7 +2554,7 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Resolution
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 * '''Last Updated''': 2017-09-18
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -2592,6 +2606,10 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 | Drive-by Compromise
 | Initial Access
 |-
+| T1537
+| Transfer Data to Cloud Account
+| Exfiltration
+|-
 | T1114.001
 | Local Email Collection
 | Collection
@@ -3413,14 +3431,24 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
 
+* [[Documentation:ESSOC:detections:Detections#Net_profiler_uac_bypass|NET Profiler UAC bypass]]
+
 * [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
 
 * [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
 
+* [[Documentation:ESSOC:detections:Detections#Sdclt_uac_bypass|Sdclt UAC Bypass]]
+
+* [[Documentation:ESSOC:detections:Detections#Silentcleanup_uac_bypass|SilentCleanup UAC Bypass]]
+
 * [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]
 
 * [[Documentation:ESSOC:detections:Detections#System_process_running_from_unexpected_location|System Process Running from Unexpected Location]]
 
+* [[Documentation:ESSOC:detections:Detections#Uac_bypass_mmc_load_unsigned_dll|UAC Bypass MMC Load Unsigned Dll]]
+
+* [[Documentation:ESSOC:detections:Detections#Wsreset_uac_bypass|WSReset UAC Bypass]]
+
 * [[Documentation:ESSOC:detections:Detections#Windows_disableantispyware_registry|Windows DisableAntiSpyware Registry]]
 
 
@@ -5173,7 +5201,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Change
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004], [https://attack.mitre.org/techniques/T1537/ T1537]
 * '''Last Updated''': 2020-08-25
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -5187,6 +5215,8 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 * [[Documentation:ESSOC:detections:Detections#Cloud_instance_modified_by_previously_unseen_user|Cloud Instance Modified By Previously Unseen User]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_shared_ec2_snapshot|Detect shared ec2 snapshot]]
+
 
 
 ====ATT&CK====
@@ -5198,6 +5228,10 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 | T1078.004
 | Cloud Accounts
 | Defense Evasion, Persistence, Privilege Escalation, Initial Access
+|-
+| T1537
+| Transfer Data to Cloud Account
+| Exfiltration
 |}
 
 
@@ -5877,7 +5911,7 @@ Detect and investigate hosts in your environment that may be communicating with
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Resolution
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 * '''Last Updated''': 2018-09-06
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -5923,6 +5957,10 @@ Detect and investigate hosts in your environment that may be communicating with
 | Drive-by Compromise
 | Initial Access
 |-
+| T1537
+| Transfer Data to Cloud Account
+| Exfiltration
+|-
 | T1114.001
 | Local Email Collection
 | Collection
@@ -6990,7 +7028,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1566.001/ T1566.001], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1590.005/ T1590.005], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1566.001/ T1566.001], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1590.005/ T1590.005], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 * '''Last Updated''': 2021-04-20
 
 <div class="toccolours mw-collapsible mw-collapsed">
@@ -7004,10 +7042,14 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
 
+* [[Documentation:ESSOC:detections:Detections#Mshta_spawning_rundll32_or_regsvr32_process|Mshta spawning Rundll32 OR Regsvr32 Process]]
+
 * [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
 
 * [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
 
+* [[Documentation:ESSOC:detections:Detections#Office_product_spawn_cmd_process|Office Product Spawn CMD Process]]
+
 * [[Documentation:ESSOC:detections:Detections#Powershell_remote_thread_to_known_windows_process|Powershell Remote Thread To Known Windows Process]]
 
 * [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
@@ -7044,6 +7086,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Process Injection
 | Defense Evasion, Privilege Escalation
 |-
+| T1218.005
+| Mshta
+| Defense Evasion
+|-
 | T1566.001
 | Spearphishing Attachment
 | Initial Access
@@ -7785,7 +7831,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 <pre>
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-07-20 21:03:23.148505 UTC
+# On Date: 2021-07-29 21:06:57.254832 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############